Email verification is required on signup

Without email verification, any user can register with someone else's email address, potentially locking the legitimate owner out of your service, triggering unwanted emails to that person, or establishing a fraudulent account linked to a real identity. CWE-287 (Improper Authentication) applies when you grant full account access without confirming control of the supplied credential. OWASP A07 (Identification and Authentication Failures) covers unverified account creation among its failure modes, and identity-proofing frameworks in NIST SP 800-63A treat unverified claimed identifiers as a category-one enrollment weakness.

Send a verification email at registration and gate access to sensitive features until the email is confirmed. Use a time-limited, single-use token for the verification link:

// src/app/api/auth/register/route.ts
const verificationToken = crypto.randomBytes(32).toString('hex')
await db.user.create({
  data: {
    email, passwordHash,
    emailVerified: false,
    verificationToken: crypto.createHash('sha256').update(verificationToken).digest('hex'),
    verificationExpiry: new Date(Date.now() + 86_400_000) // 24h
  }
})
await sendVerificationEmail(email, verificationToken)

// In middleware or layout — redirect unverified users:
if (!session.user.emailVerified) redirect('/verify-email')

NextAuth, Clerk, and Supabase Auth all support email verification natively — check configuration to confirm it's enabled rather than assuming the default is on.