User Experience Stack Exchange is a question and answer site for user experience researchers and experts. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

It's a common practice for websites to send email verification links on sign up. Should these verification links expire? I know about a bunch of website where they do and I wonder why?

share|improve this question
up vote 6 down vote accepted

There isn't any major security reason behind them expiring. The main reason that this is done is to be able to clean up the database of old unused verification information.

From a UX side, some people argue that having a shorter verification time encourages people to verify sooner rather than later, but I haven't seen any evidence supporting that. It does however fit what I would expect in human behaviour.

share|improve this answer

This is a method to keep user database current. If an email is not verified until expiration time the corresponding user account is removed from the user database.

share|improve this answer

If clicking the verification link automatically logs the user in, then yes, the verification link should expire.

Why? Because if the user's inbox is compromised a hacker can search for the verification email and then click the verification link to gain access to the user's profile on the website.

The question then is, when should the link expire. Maybe not immediately after clicking it, but for example 24 hours after the link has been clicked.

share|improve this answer
    
What would be the purpose of letting a verification link stay active after the account has been verified? You can't (at least in normal cases) re-verify an account, so there wouldn't be any legitimate reason for a user to re-click a verification link. – michael Jan 26 at 0:29
    
it sounds like @bart is making the valid case that the website account has not yet been verified and the hacker gains access to the email account – bphilipnyc Jan 26 at 6:17
    
@michael Personal experience has shown that the verification link is often clicked more than just once. People probably click the link, open a browser and then get distracted and accidentally close the tab. They click the verification link again and then get hit with an error message saying the link is expired. To account for this scenario I think it's okay to allow the user to click the verification link more than just once. – bart Jan 27 at 2:32
    
I'm not arguing that verification links are clicked more than once; I fully agree users do that a lot I'm sure. More so the point I'm trying to make is the first time it's clicked, their account is verified, so at that point make further clicks simply redirect to the log in page or home page of the website. Definitely don't show an error as there's no point. For cases where the user has to take an additional step after clicking the link, if they get distracted and do something else, then their account wouldn't be verified, which means the link would still be valid. – michael Jan 27 at 4:16
    
@michael Fully agree that an additional click should not result in an error but just forward the user to whatever page. Unless of course the link is expired and the account hasn't been verified yet. – bart Jan 28 at 0:55

If you do not need the expiration date in the email you should remove it. You should always strive to decrease friction for the user. Any information they do not need adds friction.

I went through this discussion just the other day and I'm questioning if anyone ever reads the whole message in a confirmation email in the first place.

The person who signed up most likely read a message after the sign up that they have to confirm their email and all they are doing now is trying to get access to their account. Most users are familiar with this process and will instantly click the link in the email and will never read the expiration date, and if they do they will probably ignore it.

share|improve this answer
    
My answer of course only applies if the confirmation email include the expiration date, which I assume it would. – tblessander Jan 16 '13 at 14:49

If you do not handle e-mail confirmation expiration, someone could register with someone else's e-mail address and never confirm it which would lock the e-mail of the legitimate user if he ever wants to register to your website.

If the user hasn't confirmed his e-mail address in the given length of time, you want to make it available again, in case it wasn't really his address or if he wants to register again later on. Consider the case where a user entered the wrong e-mail address by a mistake.

sauce

And while the true user with the email account can attempt to resend a verification email if the site allows for it, it would make a terrible experience for this back-and-forth.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.