Implement Deferred Profile Creation to Enhance Security and User Experience

[andylizf]

Description

To enhance our application's security and user experience, we propose refining the user registration process by explicitly separating it from the profile creation, including avatar selection. Upon registration, users will be assigned a default avatar, and the creation of a detailed profile, including uploading a custom avatar, will be deferred until after their initial login.

This approach treats the avatar as a part of the user's profile, which is not immediately required at the registration stage. If a corresponding profile is not found for a user, the system will revert to using a default avatar. This strategy minimizes potential security risks associated with immediate avatar uploads during registration and reduces the server's exposure to unnecessary resource consumption.

Proposed Changes

1. Modify User Registration Flow: Simplify the registration process to require only essential user information. Assign a default avatar to every new user upon registration.
2. Deferred Profile Customization: Allow users to complete their profile and upload a custom avatar during their first login or at a later stage, as per their convenience.
3. Security and Resource Management Enhancements:

• Implement checks and limits for avatar uploads for logged-in users to prevent potential abuse.
• Enforce upload restrictions (e.g., file size, format) and rate limiting where necessary.

Goals

• Enhance Security: By deferring profile customization, including avatar uploads, we reduce the risk of malicious exploitation.
• Improve User Experience: Streamline the registration process and provide users with the flexibility to customize their profile at their convenience.
• Optimize Resource Usage: By controlling avatar uploads and employing a default avatar system, we manage server resources more effectively.

Action Items

• Assess the current user registration and profile management systems for necessary adjustments.
• Implement the separation of registration and profile customization in the backend logic.
• Integrate enhanced security measures and upload restrictions for managing avatars.
• Conduct thorough testing to validate the functionality and security of the updated processes.

Originally proposed in #60 (comment)