Best practices for a change of email/user

Our website uses a system where the username is the user's email address. We have a function which permits the user to change his email.

What is the best way to go about this?

• Send an email only to the new email address just to confirm the change.


• Send an email to both the new and the old email addresses for confirmation.


• Send an email to the new address, asking the user to click a button for activation.


• I'm open to any different suggestions as well.

I'm concerned about functionality, security and usability. There could be some problems with activation; for example, activating an email address that has been created between the change request and the changed email activation would certainly cause some problems. I'm probably forgetting other corner cases...

Answer

The most common way is to:

1. 
   

   Ask the user to enter her password before changing e-mail (even if she is currently logged in): this will help to avoid stealing of the account if user has forgotten to logout or somebody simply got user's cookies or something like this.

   
   


2. 
   

   Send an activation link to the new address and don't switch e-mails until the new one will be activated: this will ensure that user has entered the correct e-mail address she has access to.