Home/ Questions/Q 8380503
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-09T16:28:30+00:00

I want to make an email confirmation registration, so that when the user registers

  • 0

I want to make an email confirmation registration, so that when the user registers he or she gets an email with a link to confirm it. The link being something like: www.site.com/confirm?id=34398df809as8df9 and then matching that with the UserId in the database from the standard aspnet membership provider. Is using the UserId as the guid being passed to email pose any sort of vulnerabilities or security threat?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Is the GUID the only think in the link? If so, that’s absolutely not secure. It means that once an attacker has anyone’s ID (e.g. by finding an old email) they can reset the user’s password whenever they want.

    A password reset link should at least include a single-use, time-limited token.

    • 0