Question

For many of the sites we develop, we verify the user’s email address. Typically the workflow is such:

1. User registers for site (activation email is sent with link to activate)
2. User verifies email address (by clicking aforementioned link)
3. User must log in to site in order to use it (assuming they weren’t already logged in)

Clients often complain about this process being clunky and somewhat confusing, and I agree. The proposed solution is to remove step 3 and automatically log the user in after step 2.

I’m not sure if it matters (hence the question!), but I’ve always been wary of automatically logging a user in like this. What extra security risks should I consider before implementing the suggested solution?

This also applies in situations like password resets, where the user might be logged in automatically and then made to change their password.

For the sake of this question, let’s assume that verifying the email is a hard requirement. I’m aware that there are situations where this isn’t necessary, but let’s talk about those where it is.

Answer 1

I’d make sure there is a time limit on the validness of the link in the email and make it only valid for one click.