User through the mailbox registration after the activation, high-security processing plan?

Normal steps:
1. Enter the registration page
2. Verify mailbox correctness 3, generate email account Activation Code code (self-encrypting)
4. Activation email sent to registered mailbox, including activation URL
5, click on the activation URL to determine the effective
6. Activation success, jump to landing page

Problem:
1, the above steps is perfect?
2. What does the activation code code usually contain?
3. If the registered mailbox is not owned by the registrant itself, will it be possible to activate the mailbox owner who received the activation email after clicking on it?

Reply content:

Normal steps:
1. Enter the registration page
2. Verify mailbox correctness 3, generate email account Activation Code code (self-encrypting)
4. Activation email sent to registered mailbox, including activation URL
5, click on the activation URL to determine the effective
6. Activation success, jump to landing page

Problem:
1, the above steps is perfect?
2. What does the activation code code usually contain?
3. If the registered mailbox is not owned by the registrant itself, will it be possible to activate the mailbox owner who received the activation email after clicking on it?

Segmentfault Registration The current use of the basic is that you said the process

1. This process is complete.
2. Code is just a hash value to which key should find an activation information in your storage system, of course, for security period this hash code is long enough, and the collision is lower than can, general 32-bit MD5 value can meet the requirements
3. This risk is present, so you have to sign up in the mail stating "If this message is not triggered by you, then please ignore it" such words, of course, also to the registration of such a link to set an expiration time, generally 1-3 days more appropriate, so as to avoid accidental triggering of the situation

The process is generally the same.

That's what I'm doing now:

如果不放心，那就搞复杂一些--在激活页面提供登陆渠道: 在邮箱中点链接之后进入激活页面，忽略cookie之类的信息，让用户登陆一次，根据用户名、密码和激活码三个来激活账号

还有两个部分你漏掉了。

1、每次有新用户注册，记录并验证 IP、MAIL 地址注册次数。2、发激活 MAIL 后记录此地址发信时间。

目的只有一个，就是防止有人用激活邮件做为攻击别人邮箱的工具。

