email confirmation in node js

Question

I am writing email confirmation code in node js. Following approach I am adopting

• Generate 5 digit random number
• Save user data (email, password etc) along with 5 digit random number in database (mongodb)
• send random number on email address.
• apply setTimeout() methon to wait for 20 minutes to confirm mail address
• after 20 minutes if user verifies addres then it is fine otherwise remove user data from database.

but this code goes on waiting for 20 minutes until the setTimeout period ends. is there any way to apply this strategy without waiting for 20 minutes? I know it is simple but I am not able to crack it out. Following is code...

const emailCode = Math.floor(Math.random()*90000)+10000;
    try
    {
        const user = new User({...req.body, emailCode});
        req.user = user;
        await user.save()
    }
    catch(err)
    {
        if(err.keyPattern)
        {
            res.status(409).send({err: "User Already Exists"})
        }
        else if(err.errors.email)
        {
            res.status(400).send({err: err.errors.email.message})
        }
        else if(err.errors.password)
        {
            res.status(400).send({err: err.errors.password.message})
        }
        res.status(400).send(err);
    }
    const transporter = nodemailer.createTransport({
        service: 'gmail',
        auth: {
            user: '',
            pass: ''
        }
    });
    const mailOptions = {
        from: '',
        to: req.body.email,
        subject: "Confirm Your Email Address",
        text: "Use the following 5 digit code to confirm your email address \n"+emailCode.toString()
    };
    try
    {
        const mail = await transporter.sendMail(mailOptions);
        console.log("here");
        await new Promise(resolve =>
        {
            setTimeout(resolve, 10000)
        })
        console.log("there");
        console.log(req.user.verify)
        if(!req.user.verify)
        {
            req.user.remove();
        }
    }
    catch(err)
    {
        res.send(err)
    }

Answer 1

you can also try this approach

By using the NPM Package (two-step-auth)

Use this package in your server index.js and create a route for it, and directly pass in the variables and you can do the rest,

In your app get the data from the form and pass it to your server and then to the package and it will return you an OTP to work with,

Kindly check the full procedures with the example here

Usage

const {Auth} = require('two-step-auth');

async function login(emailId){
    const res = await Auth(emailId);
    // You can follw the above approach, But we recommend you to follow the one below, as the mails will be treated as important
    const res = await Auth(emailId, "Company Name");
    console.log(res);
    console.log(res.mail);
    console.log(res.OTP);
    console.log(res.success);
}

const app = express();
app.get('./auth/mailId/CompanyName', async(req, res)=>{
    const {emailId} = req.params;
    const data  = login(emailId);
})

Output

This will give you an OTP to work with and you can save it in your server and you can use it for future auth, like do a post request to your server from the frontend when the user types in the OTP

Answer 2

We can use TTL indexes in MongoDB to do this job, suppose there is an isVerified which is by default false and is set to true when the user verifies the email

So we can add a TTL index like

db.users.createIndex( {createdAt: 1}, {
    expireAfterSeconds: 20*60, // 20 minutes
    partialFilterExpression: {
        isVerified: false
    }
});

here createdAt is the date-time when the user is registered.

TTL index will automatically remove the document after the expiration time if isVerified is still false

For reference https://docs.mongodb.com/manual/core/index-ttl/

Answer 3

Save the confirmation code's expiration time with it in the database. Then, when you verify the code, also verify that it hasn't expired.