5

As a moderator, I've seen some users lost their unregistered account and create new account. So I'm testing unregistered account behavior to help those users.

To simulate those users, I've tested with same email address and different browsers.

  1. I've asked as an unregistered user (A) with browser A, then I got 'Thanks for your post on ...' email.
  2. Some days after, I've asked with same email address but browser B, then I got another unregistered user (B) and 'Thanks for your post on ...' email.
  3. I clicked 'Set your password' link on the email for (A) from browser C and set a password.
  4. Then I should be logged in (A), but it was another account (C).

Also, /users/account-recovery sends me same link as 'Set your password'. This means, if you created many unregistered accounts for one email accidentally, these features will be useless for account recovering.

and IMHO, allowing multiple accounts (even if it's unregistered) is a root cause...

Improve this question
2
  • IIRC "unregistered" accounts are cookie-based, so it's going to be one per browser, there's no way around that. It's not clear which browser you used in point 1. Is it the same as point 3 ("browser C")? If not, then you can't really "set your password" for user A, because you don't have the cookie that identifies you as such.
    – Sklivvz
    Feb 19 '17 at 10:02
  • @Sklivvz I've tested again, and it creates new account even if only one account is associated with the email address, as you said. So it might be by-design...but same link is used for account recovery. If I can't set a password for unregistered account, they shouldn't send me "set a password" link on account recovery.
    – unarist
    Feb 19 '17 at 11:35

You must log in to answer this question.

Browse other questions tagged .