New answers tagged email
I would allow invited users to use another e-mail address then the one at which they received the invite. It's something that isn't done often unfortunately, but there are lots of people using separate e-mail addresses for registering on websites. Plus, I like the idea that a user is free to choose how he/she registers, even when it's an invite-only service. ...
I don't think they should get another verification email, you already verified that their email is theirs and it works, because they received the invite, otherwise the invite would have been lost and never "redeemed".
If you do not handle e-mail confirmation expiration, someone could register with someone else's e-mail address and never confirm it which would lock the e-mail of the legitimate user if he ever wants to register to your website. If the user hasn't confirmed his e-mail address in the given length of time, you want to make it available again, ...
If clicking the verification link automatically logs the user in, then yes, the verification link should expire. Why? Because if the user's inbox is compromised a hacker can search for the verification email and then click the verification link to gain access to the user's profile on the website. The question then is, when should the link expire. Maybe not ...
Top 50 recent answers are included