Test the Email Verification Protocol with an origin trial

通过源试用（Origin Trial）测试电子邮件验证协议

When collecting an email address as a part of a sign-up, sign-in, subscribe, checkout, account recovery, or other process, it’s common practice to confirm that the email address is owned by the person entering it. 在注册、登录、订阅、结账、账户恢复或其他流程中收集电子邮件地址时，确认该地址确实由输入者本人拥有是一种常见的做法。

Existing verification methods, like one-time passwords (OTPs) or email verification links (magic links), require the user to navigate away from your site. This disruptive process can increase the risk of the user, whether a human or an agent, abandoning their session entirely and never completing their authentication process. 现有的验证方法（如一次性密码 OTP 或电子邮件验证链接/魔法链接）需要用户离开当前网站。这种干扰性的流程可能会增加用户（无论是人类还是代理程序）完全放弃会话并导致身份验证流程中断的风险。

The Email Verification API is a proposal that allows the browser to communicate directly with the email provider to verify that the user owns the email address. Users select an email from the browser’s autofill or autocomplete suggestion, submit the form, and the site verifies the email address with the provider without sending an email or interrupting the user’s flow. “电子邮件验证 API”（Email Verification API）是一项提案，允许浏览器直接与电子邮件提供商通信，以验证用户是否拥有该电子邮件地址。用户只需从浏览器的自动填充或自动完成建议中选择一个邮箱，提交表单，网站即可与提供商完成验证，无需发送邮件，也不会打断用户的操作流程。

Email collection is a critical conversion point in a user’s journey, and Chrome would like feedback on the proposal from sites that want to verify emails, email providers that can perform the verification, and users experiencing the process. You can sign up for the origin trial today and follow the implementation instructions here. 电子邮件收集是用户旅程中的关键转化点。Chrome 希望从希望验证电子邮件的网站、能够执行验证的电子邮件提供商以及体验该流程的用户那里获得关于此提案的反馈。您可以立即注册参与源试用，并按照此处的实施说明进行操作。

Key terms

关键术语

Key terms for the Email Verification API are as follows: 电子邮件验证 API 的关键术语如下：

Verifier: The site that collects the email address and wants to verify it. The verifier is also called the Relying Party.
验证方 (Verifier)：收集电子邮件地址并希望对其进行验证的网站。验证方也称为“依赖方”（Relying Party）。
Email Provider: The service providing the user’s email address, for example gmail.com.
电子邮件提供商 (Email Provider)：提供用户电子邮件地址的服务，例如 gmail.com。
Issuer: The service that manages the account for the user’s email, for example accounts.google.com. The issuer is also called the Identity Provider.
颁发者 (Issuer)：管理用户电子邮件账户的服务，例如 accounts.google.com。颁发者也称为“身份提供商”（Identity Provider）。

In some cases, the email provider and the issuer may operate from the same domain. However, it’s important to distinguish between having an email address and having an active session for the associated account. 在某些情况下，电子邮件提供商和颁发者可能在同一个域名下运行。但需要明确区分“拥有电子邮件地址”与“拥有该关联账户的活跃会话”这两个概念。

Prerequisites

前提条件

The user must be signed in to their email provider or issuer on the same browser profile. For example, if they use Gmail, they must be signed into their Google Account. 用户必须在同一个浏览器配置文件中登录其电子邮件提供商或颁发者账户。例如，如果他们使用 Gmail，则必须登录其 Google 账户。

As a participating verifier site, you must sign up for the origin trial and provide the token on the same page as your email form. 作为参与的验证方网站，您必须注册源试用，并在包含电子邮件表单的页面上提供令牌（token）。

The user must select their email address from the autofill or autocomplete drop-down. If the user has previously entered an email address in the field, it will be offered using autocomplete. If the user has added their email address using Chrome settings “Autofill and password” (chrome://settings/autofill) it will be offered using autofill. 用户必须从自动填充或自动完成下拉菜单中选择其电子邮件地址。如果用户之前曾在该字段中输入过电子邮件地址，系统将通过自动完成功能提供该地址；如果用户已通过 Chrome 设置中的“自动填充和密码”（chrome://settings/autofill）添加了电子邮件地址，系统将通过自动填充功能提供该地址。

Email verification flow

电子邮件验证流程

The first time a user provides an email address for verification they will see a permission prompt. This only occurs once per email address. Once the user has that active session in their browser, they can start the process: 用户首次提供用于验证的电子邮件地址时，会看到一个权限提示。每个电子邮件地址仅会出现一次。一旦用户在浏览器中拥有活跃会话，即可开始该流程：

On a form with an email field, the user selects their email address from the autocomplete drop-down. 在包含电子邮件字段的表单上，用户从自动完成下拉菜单中选择其电子邮件地址。
The verifier site provides a hidden field in the form with a per-instance nonce to validate this request. 验证方网站在表单中提供一个隐藏字段，其中包含用于验证此请求的单次随机数（nonce）。
The browser will then retrieve the email verification DNS record for the email domain. This points the browser to the issuer. 浏览器随后会检索该电子邮件域名的电子邮件验证 DNS 记录，该记录会将浏览器指向颁发者。
The issuer will then confirm that they have an active session for that email address. 颁发者随后会确认该电子邮件地址是否存在活跃会话。
The issuer will then provide their Email Verification Token (EVT) for the address. 颁发者随后会为该地址提供其电子邮件验证令牌（EVT）。
The browser combines that into a key bound JWT with the EVT, the site origin, and the nonce from the input form. 浏览器将 EVT、网站源（origin）以及来自输入表单的随机数组合成一个密钥绑定的 JWT。
When the form is submitted, the EVT package is added to the hidden field and sent to the site. 提交表单时，EVT 包会被添加到隐藏字段并发送到网站。
The verifier site then verifies each of those details: the expected email address, the nonce, and signatures from the browser and issuer. 验证方网站随后会验证所有详细信息：预期的电子邮件地址、随机数，以及来自浏览器和颁发者的签名。

The user sees a small notification informing them that their email provider verified their address. This process provides the verifier site with confirmation that the email address is valid and belongs to the current user, which means the site can skip sending a verification email. 用户会看到一条小通知，告知他们电子邮件提供商已验证其地址。此过程为验证方网站提供了电子邮件地址有效且属于当前用户的确认，这意味着网站可以跳过发送验证邮件的步骤。

Use case considerations

用例考量

Email verification is a progressive enhancement to your existing flow that removes the need for a user to leave your site to retrieve an OTP or click a link. 电子邮件验证是对现有流程的渐进式增强，无需用户离开您的网站去获取 OTP 或点击链接。

EVP triggers only if the browser supports it. If no code is received on submission or any of the validation steps fail, you can fall back to your default email confirmation flow. This also means there is no feature detection for the API; the verifier site treats the EVT as optional, processing it if it is present in the request. EVP 仅在浏览器支持时触发。如果提交时未收到代码或任何验证步骤失败，您可以回退到默认的电子邮件确认流程。这也意味着该 API 没有特性检测；验证方网站将 EVT 视为可选内容，仅在请求中存在时才进行处理。

Email verification confirms that the user has an active session with the provider of their email address. It does not verify that your email reached the user. You may still want to send existing welcome or onboarding emails and may want or need to prompt the user to check their spam settings. 电子邮件验证仅确认用户与其电子邮件提供商之间存在活跃会话，并不能验证您的邮件是否已送达用户。您可能仍需要发送欢迎或入职邮件，并可能需要提示用户检查其垃圾邮件设置。