3 Different feedback mechanisms on user registration form

[thejonas]

1. Enter 'aaa' in the email field of the registration form, and valid, matching passwords, and hit "register
   button
2. A speech bubble (?) pops up saying "please enter an email address"
3. Unrelated: The speech bubble pointy part points upwards. Should it be pointing towards the email field?
4. Enter 'aaa@bbb' in the email field, etc.
5. Redirected to /register page, with red text under the email field saying "Valid email required"
   2.1 Enter 'a@foo.com' in the email field at this point, and the red warning text remains until form is submitted.
   2a. Enter a valid email , but a short password (eg. 'aa')
6. Redirected to /register page, with red text under the password field saying "This password is too insecure. Please use a password at least seven characters long."
7. Enter non-matching passwords, and red text immediately appears. As soon as the passwords match, the red text disappears
8. Unrelated: Under the red text complaining about the non-matching passwords, the text "Because if you don't remember it now, you never will" appears, also in red.

It seems like we should stick with one way of communicating (red text or bubbles), and give immediate feedback when we can.

[adamhooper]

I'll leave this bug description as-is, but clarify what we need to accomplish:

• Play's email validation should be identical to HTML5's. In this form, there should be no way for the client to say "this is a good email address" and then the server to say, "this is a bad email address." This is issue Server doesn't check valid email format on user creation #84, resolved in Play 2.1. https://play.lighthouseapp.com/projects/82401-play-20/tickets/722-email-regex-is-bad -- so it isn't part of this bug.
• We have to remove our password-security code and turn it into a regex. That's the easiest way to enable client-side validation. And if the client validates it, then normal users won't see that red text on submit, because the client won't submit an invalid string. That is part of this bug :).

More on the direction we're going:

• The bubbles are part of the web browser, not our JavaScript. We want the web browser to catch everything, because that's easier than handling it ourselves. Yay HTML5.
• Sometimes the client can't catch everything, and that's what red text is for. Once we've removed the complicated password-verification code this situation won't crop up, with our current forms. It's possible we'll have to revisit this in the future, though, because some future forms may require server-side-only validation.
• The server must validate all requests, even when our forms don't let users submit invalid data. That's because the forms are only one interface: telnet is another, and people can submit anything via telnet.

[thejonas]

Can we close this? User registration feedback is cleaner now.

[adamhooper]

No; the client still doesn't validate the password before sending it to the server.