Design notes

The thoughts behind various aspects of the design of django-openid.

Confirmation e-mails

  • Not all sites wish to implement a confirm-via-email loop (which can discourage people from signing up) so it should not be a compulsory feature.
  • People sometimes lose confirmation e-mails to spam filters and so forth - they need to be able to request that an e-mail is re-sent.
  • It’s important to be able to distinguish between users who have not yet confirmed their account and users who have been banned. This means the is_active field on the User model is not enough information - a banned user could bypass it by re-requesting their confirmation e-mail.
    • Solution: the “Unconfirmed users” group is used to mark accounts which have not yet been confirmed. Only accounts in that group are allowed to re-request confirmation e-mails.