New answers tagged


I would allow invited users to use another e-mail address then the one at which they received the invite. It's something that isn't done often unfortunately, but there are lots of people using separate e-mail addresses for registering on websites. Plus, I like the idea that a user is free to choose how he/she registers, even when it's an invite-only service. ...


I don't think they should get another verification email, you already verified that their email is theirs and it works, because they received the invite, otherwise the invite would have been lost and never "redeemed".


Slider captcha and honepot field are another alternative.


Treat a transition from federated login to mail and password the way you would treat a self-service password reset. Send a message to the address with a one-time link to create a password. Then when the user follows the link, invalidate it and open the change password form.

Top 50 recent answers are included