title: Authentication flow with node.js
body: <p>i am building authentication microservice, with email confirmation, problem is that in past, i used randomly generated string (<code>crypto.randomBytes(20).toString('hex')</code>) it worked fine until it became a headache when gmail decided that zoho emails containing links to my website (hosted on aws, and literally configured every single bit (SPF,DKIM,everything mentioned in zoho instructions), that zoho advised, in Route53) should go to spam, that's why i had to do emergency switch to code authentication, where i send 5-6 digit code that user has to confirm, and this is quite common as i see in many websites, (which is what i am using in this microservice atm), i generate random number, iterate over users, check if there is any user with that code, if there is do it again, but break the loop if it exceeds max number of iterations, defined in config file (3), now problem i see is that even though max 6 digit number is 999999, it can become problem while scaling up, many simultaneous user registration with delayed verification + attacker spamming user codes, it can become trouble quite soon, even if i have separate microservice for cleaning up expired codes, it may still be concern, if user experiences existing code presence many times (UX Problem), what is standart solution for this? i have searched it all over google but found nothing special and most of boilerplates are using encoded strings.</p>