Take the 2-minute tour ×
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.

I am working on a system where the administrator can configure the following behaviour for email addresses:

  • Allow users to attach multiple email addresses to their account (just like Facebook and Linkedin).
  • Only allow 1 email to be attached to each account.

As email addresses are used to log into the system, ensuring that users have the entered the correct email address is very important. We do this by sending them an email with a link to confirm the email address if they add a new email address or change their email address.. This has to be done before that email address can be interacted with/used on the site.

The question is: Once the user clicks the link in the email, should we automatically log them in, or should we force them to enter their email address and password to login? This is assuming that the user is not logged into the site yet.

Are there any preceived and actual security implications of automatic logging in the user on confirmation of the address?

share|improve this question
    
Why don't you relate a link with an action only? That way, a link would be provided with a permission to perform particular action while not easing the security policy. Also, I am not sure, but I feel like different users would have different expectations. People with small technical knowledge would probably like an autologin feature, but more technically advanced users would probably share a security concerns with you. Who are your users? –  Bartosz Rakowski Oct 1 '12 at 9:15
add comment

2 Answers

If you are confident that the only way that the email was triggered was as a result of an action of a logged in admin user, then you should be OK. Not requiring another log-in is a better experience, unless the site contains highly sensitive information and/or the admin would feel better and, therefore, perceive greater security in having to log in again.

share|improve this answer
add comment

Why not let the users decide themselves? Offer a "log me in now" button on the confirmation page, and they can choose whether they just wanted to quickly confirm the address or go on and use the website.

share|improve this answer
2  
I feel that having a gateway page like that would introduce extra unneeded complexity over a pretty trivial process in the workflow. Of course, I could be wrong :) –  F21 Sep 30 '12 at 11:15
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.