Personally, I'd suggest a "user invitation system", or just have the admin create the accounts straight out.
The idea of "security in depth" says you shouldn't allow anyone any more access than they absolutely need. If you disable registration, you put up one more barrier between the naughty people and your data.
With registration disabled, you have some options (the below being just some examples):
The most straight forward and secure method is probably to just have the admin create the accounts out right. If you know what the emails will be, that's probably the choice I'd go with.
Yes, that does sound like the best way to go - the admin already has to take action for each new user so I will have them create the whole account instead as it isn't a lot of extra work.
Thanks very much.
Of course! Glad I could be your rubber duck. ;)
Sign in to participate in this thread!
We'd like to thank these amazing companies for supporting us
The Laravel portal for problem solving, knowledge sharing and community building.