Help with our Signup/Register flow and big security flaws

nik.baleca
Thu, 22 Jan 2026 16:17:58 +0000

It all feels like a bit of an afterthought I have to say. Is your suggested flow documented anywhere?

Unfortunately not since the behaviour would be expected. If the user receive a pw reset email or if they sent one themselves via the login page, the outcome or process is fundamentally the same.

I understand your concept but it gets a bit blurry for me when you suggest that I need to trigger a ‘password change’ ticket once the user is verified? Would this be generated via API integration or a hook in Auth0 itself? If the answer is API, then how do I know the user has been verified to send a ‘password change’ ticket.

You would need to first generate a password change and email verification ticket via the Management API as I have linked above. The single link will both verify the user and trigger a password reset for them.

Secondly, you mention to attach an ‘email verification ticket’ inside the verification email with a result_url param. Is this just a redirect to a password change once the user has verified themselves? I’m a little confused by the 3rd point as it seems as though you’re suggesting to send a ‘password change’ ticket prior to the verification email and pass the general result_url into the verification email..

I understand your confusion and I will try to be as clear as possible.
Once the proper URL has been created for the Email Verification Ticket(which will include the Password Change Ticket as a result_url), you will need to send this URL to the user via email. The email template can be anything of your choosing, either a Welcome Email, Verification Email or Password Change Email should be good enough to use. The email itself will contain the verification ticket which upon being clicked, will immediately verify the user’s email and set email_verified to true and they will be redirected to the password change ticket where they will be prompted to set their new password. If the user attempts to reset the password outside of this flow, they will be redirected to a custom error page indicating that they need to set the password through the specific email.
Inside the email that you will be sending, there will not be different links for password change or verification, it will be a single url which both verifies the user and redirects them to the password change screen.

If you need any further clarification or some examples of the flow, please let me know!

Kind Regards,
Nik