Disable account creation be default in Drupal

+1 for this idea. Providing the most secure option as the default makes sense.

+1

+1. I have to do this on every site I set up. Admin-only should be the default until folks opt-in to something more permissive.

I updated the minimal test to match new defaults.

1. Changes look reasonable to me, and IMHO are all in scope.
2. Pipeline is green.
3. I took a stab at a release note snippet (which we'll definitely need).
4. I'm not sure if this needs a CR for distribution maintainers, too.
5. Bumping to RTBC so the Product managers will see it and make a final call both on the change, and the need for a CR or not.

Thanks!
-Derek

This feature to some extent goes together with the Comment module because this way you can get your username verified. I still think it makes sense to disable this behavior by default because usually if you want to accept registrations on the site, that's would be an explicit decision. It seems fine to require an extra step for that, given that there's likely couple of other extra steps you'd have to take in order to avoid getting tons of spam accounts.

I agree with Lauri and others above. Unfortunately the internet became a place where you need to set up extensive protections to even attempt to enable user registration publicly. :/ Most of those don't come with core so you may be in for some nasty surprises before you may have a chance to set up the tools to avoid it.

Added a review comment to the MR - we need to add a positive assertion to the test now that we changed an assertion to a negative one.

I addressed @alexpott's feedback, I'll create a change record, I didn't see anyone say it's necessary, but I suspect it will be.

CR created.

1. I made a very minor edit to the CR. Agreed it’s worth having.
2. Good catch on the test comment. Apologies I missed that. That’s what I get for quickly reviewing on my phone. 😅
3. Changes look good. Feedback addressed. Pipeline is green.

Back to RTBC.

Thanks,
-Derek

Committed b719931 and pushed to 11.x. Thanks!

Automatically closed - issue fixed for 2 weeks with no activity.