What is the high security solution for activation after a user registers via email?

Under normal circumstances, steps: 1. Enter the registration page 2. Verify the email correctness 3. Generate the email account activation code (self-encryption) 4. Send the email to the registered email address, including activating URL5, clicking the activation URL to determine whether the activation takes effect 6. Activation successful, jump to the login page: 1. the above steps... steps under normal circumstances:
1. Enter the registration page
2. verify email correctness 3. Generate email account activation code (self-encryption)
4. An activation email sent to the registered email address, including the activation URL
5. Click the activation URL to determine whether the URL takes effect.
6. Activation successful. Go to the login page.

Problem:
1. Are the above steps complete?
2. What content does the activation code generally contain?
3. If the registered email address is not owned by the registrant, can the registrant activate the email address after clicking it?

Reply content:

Steps under normal circumstances:
1. Enter the registration page
2. verify email correctness 3. Generate email account activation code (self-encryption)
4. An activation email sent to the registered email address, including the activation URL
5. Click the activation URL to determine whether the URL takes effect.
6. Activation successful. Go to the login page.

Problem:
1. Are the above steps complete?
2. What content does the activation code generally contain?
3. If the registered email address is not owned by the registrant, can the registrant activate the email address after clicking it?

Currently, SegmentFault registration is based on the process you mentioned.

1. This process is complete
2. The code is just a hash value, and the key should find an activation information in your storage system. Of course, this hash code should be long enough for security, in addition, the collision performance must be relatively low. Generally, the 32-bit md5 value can meet the requirements.
3. This risk exists, so you need to explain in the registered email that "if this email is not triggered by you, ignore it" and so on, of course, you need to set an expiration time for such registration links. Generally, it is more appropriate to set an expiration time for 1 to 3 days. This will avoid false triggering.

The process is basically the same.

I am doing this now:

If you are not at ease, make it more complicated-provide login channels on the activation page: Enter the activation page after clicking the link in the mailbox, ignore information such as cookies, and allow users to log on once, activate the account based on the user name, password, and activation code.

There are two more parts you missed.

1. Each time a new user is registered, record and verify the number of registered IP addresses and MAIL addresses. 2. Record the MAIL sending time of the address after sending the activation MAIL.

There is only one purpose, which is to prevent the use of activated emails as a tool to attack others' mailboxes.