Email verification pattern in Flask - Step-by-Step Execution

Concept Flow - Email verification pattern

User registers with email

↓

Generate unique token

↓

Send email with verification link

↓

User clicks link

↓

Verify token validity

↓

Activate user

↓

Done

This flow shows how a user registers, receives a verification email, clicks the link, and the system verifies the token to activate the account.

Execution Sample

Flask

from flask import Flask, request, redirect
from itsdangerous import URLSafeTimedSerializer

app = Flask(__name__)
serializer = URLSafeTimedSerializer('secret-key')

@app.route('/verify/<token>')
def verify_email(token):
    try:
        email = serializer.loads(token, max_age=3600)
        # Activate user here
        return 'Email verified for ' + email
    except Exception:
        return 'Invalid or expired token'

This Flask route verifies the email token from the URL, activates the user if valid, or shows an error if invalid.

Execution Table

Step	Action	Input/State	Result	Next Step
1	User registers	User email: [e-mail]	Generate token for [e-mail]	Send verification email
2	Send email	Token embedded in link	Email sent with link /verify/<token>	User clicks link
3	User clicks link	Token received in URL	Call verify_email(token)	Try to decode token
4	Decode token	Token valid and not expired	Extract email [e-mail]	Activate user
5	Activate user	Email extracted	User marked as verified	Return success message
6	Return response	User verified	Show 'Email verified for [e-mail]'	End
7	If token invalid	Token invalid or expired	Catch exception	Return error message
8	Return error	Invalid token	Show 'Invalid or expired token'	End

💡 Execution stops after returning success or error message based on token validity.

Variable Tracker

Variable	Start	After Step 1	After Step 3	After Step 4	Final
email	None	[e-mail]	[e-mail] (from token)	[e-mail]	[e-mail]
token	None	token string generated	token string received	token string decoded	token string decoded
user_verified	False	False	False	True	True

Key Moments - 3 Insights

Why do we need to check token expiration?

Because the token might be old or reused. Step 4 in the execution_table shows token decoding with max_age=3600 seconds to ensure it is still valid.

What happens if the token is invalid or tampered?

Step 7 shows catching an exception when decoding fails, leading to an error message in Step 8. This prevents unauthorized activation.

How does the system know which user to activate?

The token encodes the user's email (Step 4). After decoding, the email identifies the user to activate in Step 5.

Visual Quiz - 3 Questions

Look at the execution_table, what is the result at Step 4 when the token is valid?

A Show error message

B Extract email [e-mail]

C Generate token

D Send verification email

💡 Hint

Check the 'Result' column in Step 4 of the execution_table.

At which step does the system mark the user as verified?

A Step 7

B Step 3

C Step 5

D Step 2

💡 Hint

Look for 'Activate user' action in the execution_table.

If the token expires after 1 hour, what happens at Step 4?

A Exception is raised and caught

B User is activated anyway

C Token is decoded successfully

D Email is sent again

💡 Hint

Refer to the 'Try to decode token' and exception handling in Steps 4 and 7.

Concept Snapshot

Email verification pattern in Flask:
- User registers with email
- Generate unique token with expiration
- Send email with verification link
- User clicks link, token decoded
- If valid, activate user
- If invalid/expired, show error
Use itsdangerous for secure tokens.

Full Transcript

This example shows how Flask handles email verification. When a user registers, the system creates a unique token encoding their email with a time limit. It sends an email containing a link with this token. When the user clicks the link, Flask receives the token and tries to decode it. If the token is valid and not expired, the system activates the user's account and shows a success message. If the token is invalid or expired, it shows an error message. This protects against fake or old verification attempts and ensures only the rightful user can activate their account.

Practice

1. What is the main purpose of email verification in a Flask application?

easy

A. To store user data securely in the database

B. To confirm that the user owns the provided email address

C. To speed up the login process

D. To encrypt the user's password

Solution

1. Step 1: Understand email verification purpose

   Email verification is used to confirm that the user actually owns the email they provided during signup.

2. Step 2: Differentiate from other security tasks

   Encrypting passwords and speeding login are different tasks unrelated to email verification.

3. Final Answer:

   To confirm that the user owns the provided email address -> Option B

4. Quick Check:

   Email verification = Confirm ownership [OK]

Hint: Email verification confirms user email ownership [OK]

Common Mistakes:

• Confusing email verification with password encryption
• Thinking it speeds up login
• Assuming it stores data securely

2. Which Flask library is commonly used to create timed tokens for email verification?

easy

A. flask_sqlalchemy

B. flask_login

C. itsdangerous

D. flask_mail

Solution

1. Step 1: Identify token generation library

   The itsdangerous library provides URLSafeTimedSerializer to create timed tokens.

2. Step 2: Differentiate from other Flask extensions

   flask_sqlalchemy manages databases, flask_login handles user sessions, and flask_mail sends emails but does not create tokens.

3. Final Answer:

   itsdangerous -> Option C

4. Quick Check:

   Token creation = itsdangerous [OK]

Hint: Use itsdangerous for timed token creation [OK]

Common Mistakes:

• Choosing flask_mail for token creation
• Confusing flask_login with token generation
• Selecting flask_sqlalchemy incorrectly

3. Given this Flask code snippet, what will verify_token(token) return if the token is expired?

from itsdangerous import URLSafeTimedSerializer, SignatureExpired

serializer = URLSafeTimedSerializer('secret-key')

def verify_token(token):
    try:
        email = serializer.loads(token, max_age=3600)
        return email
    except SignatureExpired:
        return None

medium

A. Returns None

B. Raises a SignatureExpired exception

C. The email string inside the token

D. Returns an empty string

Solution

1. Step 1: Understand token verification logic

   The function tries to load the token with a max age of 3600 seconds (1 hour).

2. Step 2: Handle expired token exception

   If the token is expired, it raises SignatureExpired, which is caught and returns None.

3. Final Answer:

   Returns None -> Option A

4. Quick Check:

   Expired token returns None [OK]

Hint: Expired tokens return None in try-except block [OK]

Common Mistakes:

• Expecting exception to propagate
• Assuming it returns empty string
• Thinking it returns the email anyway

4. Identify the error in this Flask email verification token generation code:

from itsdangerous import URLSafeTimedSerializer

serializer = URLSafeTimedSerializer('secret-key')

def generate_token(email):
    token = serializer.dumps(email)
    return token

# Later verification
email = serializer.loads(token, max_age=3600)

medium

A. Token variable is undefined at verification

B. Missing secret key in serializer initialization

C. max_age parameter is invalid in loads()

D. Using dumps() instead of loads() to verify

Solution

1. Step 1: Check token generation and usage

   The token is generated inside generate_token but not stored or passed outside.

2. Step 2: Verify token usage scope

   At verification, token is used but not defined in that scope, causing a NameError.

3. Final Answer:

   Token variable is undefined at verification -> Option A

4. Quick Check:

   Undefined token variable causes error [OK]

Hint: Ensure token variable is defined before verification [OK]

Common Mistakes:

• Ignoring variable scope for token
• Thinking secret key is missing
• Misusing max_age parameter

5. You want to implement email verification in Flask so that users receive a link with a token that expires after 24 hours. Which approach correctly combines token creation, sending email, and verification?

hard

A. Generate token without secret key, send email, verify token ignoring expiration

B. Store plain email in database, send email without token, verify by matching email only

C. Send token as plain text in email body, verify token with max_age=3600

D. Generate token with URLSafeTimedSerializer, send email with token link, verify token with max_age=86400

Solution

1. Step 1: Create token with expiration

   Use URLSafeTimedSerializer with a secret key to generate a token that expires after 86400 seconds (24 hours).

2. Step 2: Send email with token link and verify properly

   Send the token inside a URL link in the email. Verify the token using loads() with max_age=86400 to enforce expiration.

3. Final Answer:

   Generate token with URLSafeTimedSerializer, send email with token link, verify token with max_age=86400 -> Option D

4. Quick Check:

   Token creation + email + 24h expiry = Generate token with URLSafeTimedSerializer, send email with token link, verify token with max_age=86400 [OK]

Hint: Use max_age=86400 for 24h token expiry [OK]

Common Mistakes:

• Not using tokens in email links
• Ignoring token expiration
• Sending tokens without secret key