3

We have a system where an employer will register a user to our system. Employer has the persons name, and email address. The system creates a new account and an email is sent to the new user with a username, a randomly generated password and link to our site.

The user logs in with credidentials and is imediataly prompted to change their password before the can continue.

What is a better way to perform this process that doesn't involve sending temporary passwords in email?

1 Answer 1

6

Generally the system will generate a time-based token for activation purpose and send it to the user which will lead to a password creation page to complete the registration process. Below shows the scenario flow:-

  1. Employer register a new user with profile info
  2. System generate a token and send it to user's email
  3. User click on the token-embeded link and redirected to a password creation page which inform the user the account will be ready after setting up the password.
  4. Invalidate the token after completing the registration process.

I've seen 2 different implementations after step 4:

  • Redirect the user to login page
  • User was now authenticated to access the system

but I prefer the latter since the user don't need to key in the password again. Hope this helps!

2
  • You suggest a time based token. What should the process be if the token has expired and user tries to log in?
    – Tadhg
    Commented Apr 28, 2017 at 10:22
  • 1
    The short-lived token is use to prevent the user for holding the account creation indefinitely as there's no good reason to allow click on an activation email after 30 days. In this case the user should be notified that the link is not working and require to contact the administrator (employer) which in turn will regenerate a new token again. The time period can range from few hours to few days and you'll have to balance between usability and security.
    – Zephyr
    Commented Apr 28, 2017 at 14:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.