Help with our Signup/Register flow and big security flaws

jharrison
Thu, 22 Jan 2026 07:26:02 +0000

nik.baleca:

password

Hey @nik.baleca thanks for your reply, really helpful. I’m a little suprised that this flow is not catered for without such workarounds. It all feels like a bit of an afterthought I have to say. Is your suggested flow documented anywhere?

I understand your concept but it gets a bit blurry for me when you suggest that I need to trigger a ‘password change’ ticket once the user is verified? Would this be generated via API integration or a hook in Auth0 itself? If the answer is API, then how do I know the user has been verified to send a ‘password change’ ticket.

Secondly, you mention to attach an ‘email verification ticket’ inside the verification email with a result_url param. Is this just a redirect to a password change once the user has verified themselves? I’m a little confused by the 3rd point as it seems as though you’re suggesting to send a ‘password change’ ticket prior to the verification email and pass the general result_url into the verification email..

Apologies if that is all a bit wordy and thank you again