Quality of Life for Authentication about muesli HOT 1 CLOSED

I just talked to someone about this and thought I'd see if this is still the case :)

Solution:
Convert email adress to lowercase and strip trailing and leading spaces. Don't forget to update the database - in case someone actually has used uppercase letters or spaces in his registration.

Unfortunately, this solution isn't quite this simple. The reason is, that there are people who have multiple accounts, with different capitalization (because they tried logging in from a different browser, their account couldn't be found and they decided to re-register). You can't simply merge them, because there will be merge conflicts.

So, lower-casing everything in the database is not possible (as that would create multiple accounts with the same E-Mail Address) and lower-casing on registration and login is not possible (as that would disallow logging into an account with upper-case letters).

A fix would be, to insert accounts always lowercased and search always case-insensitive. You can then handle on the application layer what to do. On registration, you can search case-insensitively whether that account exist and refuse if any case-variant already does. On login, you search case-insensitively and if there is exactly one match, you treat them as equal and try to log in that one. If there is more than one match, you treat them as different and look for one with that exact casing. You can also show warnings if conflicts are shown.

Of course, this requires some application-level code, but it should be manageable. You can opt to lower-case all accounts in the DB that are already conflict-free. Once there are no more "conflicting" accounts, you can clean up.

from muesli.