identity: prevent users with disposable emails from signing up

while this is not a perfect way to prevent abuse of service, we do want to avoid getting spammed with fake accounts. Creating a valid email account is significantly more cumbersome than using a disposable email address. Currently the list of blacklisted domains is extracted from https://github.com/disposable/disposable and it is refreshed after every 24 hours.
2023-03-02 17:43:10 +05:00
parent 5d5c179810
commit 20eec79cef
2 changed files with 40 additions and 2 deletions
@@ -0,0 +1,36 @@
+using System;
+using System.Collections.Generic;
+using System.Net.Http;
+using System.Threading.Tasks;
+using Streetwriters.Common;
+
+namespace Streetwriters.Identity.Services
+{
+    public class EmailAddressValidator
+    {
+        private static DateTimeOffset LAST_FETCH_TIME = DateTimeOffset.MinValue;
+        private static HashSet<string> BLACKLISTED_DOMAINS = new HashSet<string>();
+
+        public static async Task<bool> IsEmailAddressValidAsync(string email)
+        {
+            var domain = email.ToLowerInvariant().Split("@")[1];
+            try
+            {
+                if (LAST_FETCH_TIME.AddDays(1) < DateTimeOffset.UtcNow)
+                {
+                    var httpClient = new HttpClient();
+                    var domainsList = await httpClient.GetStringAsync("https://disposable.github.io/disposable-email-domains/domains.txt");
+                    BLACKLISTED_DOMAINS = new HashSet<string>(domainsList.Split('\n'));
+                    LAST_FETCH_TIME = DateTimeOffset.UtcNow;
+                }
+
+                return !BLACKLISTED_DOMAINS.Contains(domain);
+            }
+            catch (Exception ex)
+            {
+                await Slogger<EmailAddressValidator>.Error("IsEmailAddressValidAsync", ex.ToString());
+                return BLACKLISTED_DOMAINS.Count > 0 ? !BLACKLISTED_DOMAINS.Contains(domain) : true;
+            }
+        }
+    }
+}