I am just setting out a new website that needs to be secured and I'm struggling to work out how to secure the registration pages. The registration process is complicated and involves them requesting a code to be posted to their address, so when they get that letter they have to come back to the website and authenticate themselves with this one off code, then continue with the registration process to setup password etc. I don't want to set the auth cookie before registration is complete as they will be able to get into the main part of the website without having setup a password etc, and also I don't want them to be able to register until we have checked their one off code. Do I need to use 2 different auth cookies? I haven't seen this before on other websites I've worked on and it seems wrong somehow.
...
Go to the complete details ...