登录失败时自动重发邮箱确认邮件的安全性探讨（替代手动触发）

Great question—let’s break down the security risks and tradeoffs here clearly. The short answer is: yes, there are meaningful security and usability issues with this approach, even if the spam concern seems similar to the original two-step flow.

Key Risks to Consider #

• Account Enumeration Vulnerability
  This is the most critical risk. An attacker could use repeated login attempts to figure out which email addresses are registered on your platform. If your auto-resend triggers only when the email exists in your system, the attacker can infer valid accounts (e.g., by checking for consistent response timing, or noting that no error is thrown for valid emails). The original two-step flow avoids this: you can show the same “Would you like to resend your verification email?” prompt for both registered and unregistered emails, hiding that sensitive account existence info from bad actors.

• Amplified Spam/Harassment Potential
  You’re right that spam is a concern in both flows, but auto-resending makes it worse. An attacker could target a single registered email with dozens (or hundreds) of login attempts, triggering an equal number of verification emails to flood the user’s inbox. In the original flow, the user has to explicitly request a resend each time—so even if an attacker gets access to the login screen, they can’t automate a spam attack without manual input per attempt. Auto-resending removes that guardrail, turning a minor annoyance into a viable harassment or denial-of-service tactic.

• User Confusion and Eroded Trust
  Think about a user who already verified their email but forgot their password. They try to log in, fail, and suddenly get a random verification email out of nowhere. This will confuse them—they might assume their account is compromised, or that your system is broken. The original flow sets clear context first (“Your email hasn’t been verified yet”) before offering to resend, which prevents this unnecessary anxiety and builds trust.

How the Original Flow Mitigates These Risks #

The two-step process isn’t just extra clicks—it’s a safety layer:

1. Hides account existence: By presenting the same resend prompt for all emails (valid or not), you don’t give attackers clues about which accounts exist.
2. User-controlled resends: The user chooses when to get another email, so automated flooding isn’t possible.
3. Clear context: Users understand why they’re being asked to resend a verification link, reducing confusion.

A Compromise to Streamline Without Risk #

If you want to make the flow smoother without opening these vulnerabilities, try this middle ground: after telling the user “Your email hasn’t been verified yet,” automatically send one verification email and explicitly inform them (“We’ve just sent another verification link to your inbox”). This keeps the user in the loop, avoids account enumeration (if you still show the same message for unregistered emails), and limits extra emails to one per failed login attempt.

内容的提问来源于stack exchange，提问作者user179876