Les e-mails d’alerte de sécurité sont essentiels pour protéger les comptes utilisateurs. Ils doivent être clairs, actionnables et arriver instantanément. Voici comment concevoir des notifications de sécurité efficaces.
Types d’alertes de sécurité
Notifications de connexion
interface LoginAlert {
user: { email: string; name: string };
login: {
timestamp: Date;
ip: string;
location?: { city: string; country: string };
device: string;
browser: string;
};
isNewDevice: boolean;
isNewLocation: boolean;
}
await sendEmail({
to: user.email,
subject: login.isNewDevice
? 'New device signed in to your account'
: 'New sign-in to your account',
template: 'login-alert',
data: {
user,
login,
secureAccountUrl: `${baseUrl}/security`,
notYouUrl: `${baseUrl}/security/report?session=${sessionId}`
},
priority: 'high'
});
Confirmation de changement de mot de passe
await sendEmail({
to: user.email,
subject: 'Your password was changed',
template: 'password-changed',
data: {
user,
changedAt: new Date(),
device: request.device,
location: request.location,
resetUrl: `${baseUrl}/reset-password`,
supportEmail: '[email protected]'
}
});
Avertissement d’activité suspecte
interface SuspiciousActivityAlert {
user: User;
activity: {
type: 'failed_logins' | 'unusual_location' | 'api_abuse' | 'data_export';
details: string;
timestamp: Date;
riskLevel: 'low' | 'medium' | 'high';
};
recommendedActions: string[];
}
await sendEmail({
to: user.email,
subject: '⚠️ Unusual activity detected on your account',
template: 'suspicious-activity',
data: {
user,
activity,
recommendedActions: [
'Change your password',
'Review recent activity',
'Enable two-factor authentication'
],
securityDashboardUrl: `${baseUrl}/security`,
lockAccountUrl: `${baseUrl}/security/lock?token=${lockToken}`
},
priority: 'high'
});
E-mails d’authentification à deux facteurs
Confirmation d’activation du 2FA
await sendEmail({
to: user.email,
subject: 'Two-factor authentication enabled',
template: '2fa-enabled',
data: {
user,
method: '2fa.method', // 'authenticator' | 'sms' | 'email'
backupCodes: user.hasBackupCodes,
manageUrl: `${baseUrl}/security/2fa`
}
});
Codes de secours régénérés
await sendEmail({
to: user.email,
subject: 'New backup codes generated',
template: 'backup-codes-regenerated',
data: {
user,
generatedAt: new Date(),
device: request.device,
warning: 'Your old backup codes no longer work',
viewCodesUrl: `${baseUrl}/security/backup-codes`
}
});
Gestion des sessions et des appareils
Nouvel appareil ajouté
await sendEmail({
to: user.email,
subject: 'New device added to your account',
template: 'new-device',
data: {
user,
device: {
name: deviceInfo.name,
type: deviceInfo.type,
browser: deviceInfo.browser,
os: deviceInfo.os,
addedAt: new Date()
},
location: deviceInfo.location,
removeDeviceUrl: `${baseUrl}/security/devices/${deviceId}/remove`,
viewAllDevicesUrl: `${baseUrl}/security/devices`
}
});
Toutes les sessions terminées
await sendEmail({
to: user.email,
subject: 'All sessions signed out',
template: 'sessions-terminated',
data: {
user,
terminatedAt: new Date(),
terminatedBy: 'you', // or 'admin' or 'security_system'
sessionsCount: terminatedCount,
reason: 'Password change', // or 'Security concern' or 'User request'
signInUrl: `${baseUrl}/login`
}
});
Alertes API et jetons d’accès
Clé API créée
await sendEmail({
to: user.email,
subject: 'New API key created',
template: 'api-key-created',
data: {
user,
apiKey: {
name: key.name,
prefix: key.prefix, // First 8 chars only
permissions: key.permissions,
createdAt: new Date()
},
manageKeysUrl: `${baseUrl}/settings/api-keys`
}
});
Activité API inhabituelle
await sendEmail({
to: user.email,
subject: 'Unusual API activity detected',
template: 'api-activity-alert',
data: {
user,
activity: {
keyName: key.name,
requestCount: activity.count,
timeWindow: '1 hour',
normalRange: '100-500 requests',
actualCount: activity.count
},
revokeKeyUrl: `${baseUrl}/settings/api-keys/${key.id}/revoke`,
viewLogsUrl: `${baseUrl}/settings/api-keys/${key.id}/logs`
}
});
Processus de changement d’e-mail
Demande de changement d’e-mail
// Send to OLD email
await sendEmail({
to: user.currentEmail,
subject: 'Email change requested',
template: 'email-change-requested',
data: {
user,
newEmail: maskEmail(newEmail),
requestedAt: new Date(),
cancelUrl: `${baseUrl}/security/email-change/cancel?token=${cancelToken}`,
expiresIn: '24 hours'
}
});
// Send to NEW email
await sendEmail({
to: newEmail,
subject: 'Verify your new email address',
template: 'email-change-verify',
data: {
user,
verifyUrl: `${baseUrl}/security/email-change/verify?token=${verifyToken}`,
expiresIn: '24 hours'
}
});
Bonnes pratiques pour les alertes de sécurité
Priorité et timing
const securityEmailConfig = {
// Immediate, high priority
immediate: [
'password_changed',
'email_changed',
'suspicious_activity',
'2fa_disabled',
'all_sessions_terminated'
],
// Can batch or slight delay
batchable: [
'new_login_known_device',
'api_key_created',
'settings_changed'
]
};
async function sendSecurityAlert(type: string, data: any) {
const isImmediate = securityEmailConfig.immediate.includes(type);
await sendEmail({
...data,
priority: isImmediate ? 'high' : 'normal',
headers: {
'X-Priority': isImmediate ? '1' : '3',
'X-Security-Alert': 'true'
}
});
}
Actions claires à entreprendre
// Always include:
// 1. What happened
// 2. When it happened
// 3. What to do if it was you
// 4. What to do if it wasn't you
const securityEmailStructure = {
whatHappened: 'Your password was changed',
when: formatDateTime(event.timestamp),
where: `${event.location.city}, ${event.location.country}`,
device: event.device,
ifYou: 'No action needed. You can ignore this email.',
ifNotYou: {
actions: [
{ label: 'Reset your password', url: resetUrl },
{ label: 'Contact support', url: supportUrl }
],
urgency: 'Do this immediately to secure your account'
}
};
Bonnes pratiques
- —Envoyer immédiatement — les alertes de sécurité doivent arriver en temps réel
- —Objets clairs — l’utilisateur doit comprendre le problème rien qu’en lisant l’objet
- —Inclure le contexte — heure, localisation, informations sur l’appareil
- —Fournir des actions — prochaines étapes claires pour les deux scénarios
- —Ne pas inclure de données sensibles — pas de mots de passe ni de jetons complets dans les e-mails
- —Utiliser une identité visuelle cohérente — pour que les utilisateurs reconnaissent les alertes légitimes
- —Tester la délivrabilité — les e-mails de sécurité doivent arriver en boîte de réception, pas en spam
Les alertes de sécurité instaurent la confiance. Quand les utilisateurs savent que vous veillez sur eux, ils se sentent plus en sécurité en utilisant votre produit.