new: dev: hardening the registration process with removing the not activated registrations #14

src/Controller/SecurityController.php

@@ -44,6 +44,8 @@ use Symfony\Component\Security\Http\Authentication\AuthenticationUtils;
 #[AsController]
 class SecurityController extends AbstractController
 {
+    private const string ACTIVATION_TOKEN_TTL = '+24 hours';
+
     public function __construct(
         private readonly EntityManagerInterface                  $em,
         private readonly RequestStack                            $requestStack,
@@ -92,6 +94,7 @@ class SecurityController extends AbstractController
 
             $user->isVerified = false;
             $user->verificationToken = $token;
+            $user->verificationTokenExpiresAt = new DateTime(self::ACTIVATION_TOKEN_TTL);
             $user->password = $this->passwordHasher->hashPassword($user, $form->get('plainPassword')->getData());
 
             $this->em->persist($user);
@@ -194,13 +197,14 @@ class SecurityController extends AbstractController
     {
         $user = $this->em->getRepository(User::class)->findOneBy(['verificationToken' => $token]);
 
-        if (!$user) {
-            $this->addFlash('error', 'This activation link is invalid or has already been used.');
+        if (!$user || $user->verificationTokenExpiresAt === null || $user->verificationTokenExpiresAt <= new DateTime()) {
+            $this->addFlash('error', 'This activation link is invalid, expired, or has already been used.');
             return $this->redirectToRoute('MineSeekerBundle_login');
         }
 
         $user->isVerified = true;
         $user->verificationToken = null;
+        $user->verificationTokenExpiresAt = null;
         $this->em->flush();
 
         $this->activationNotificationEmail->send($user, new DateTime());