0

Let's say I have a SaaS platform, like a B2B platform where there are company accounts.

In this platform users can invite other users to join the company account by sending them an invitation link in an email with a secure token (à la Google Drive or GitHub).

Should we then let the invited user subscribe using a different email from the one where they received the invitation ?

That question regards primarily UX experience, although some security concerns might also be raised (I couldn't find a more appropriate site for that kind of questions).

  • So from the UX point of view, your question is: Should you allow user to do what they want to without you interfering their doings? – locationunknown Nov 13 '19 at 15:01
  • @locationunknown Well, the other UX-focused outcome to consider might be how frustrating/dangerous it might be for someone to intercept that token and commandeer your invite. – maxathousand Nov 13 '19 at 15:10
  • @locationunknown Except after rereading it, it sounds like more of just an "invite others to join!" that happens to have a unique ID. The one inviting may not know the email address that the invitee would like to use for their account (and should not care). So I'm with you now. (I'll write up an answer if you don't get around to it first.) – maxathousand Nov 13 '19 at 15:13
  • @maxathousand it's no "invite to join" its more "invite to join and give access", like if you invite someone to join your organization on GitHub for instance (so there is a privilege/access granted by the invitation) – Weier Nov 13 '19 at 15:28
1

Tie the invitation to a specific email address.

As you mentioned, this is invite code grants permissions to your service, so it should be handled carefully, perhaps even on the level of a password reset link, where it expires after a period of time.

Businesses typically issue their own email addresses to their clients, so there will likely be no question of which email address an invited user would like to use. By tying it to an email address, the "Inviter" can strictly control which email addresses have access, and ensure that account access can be restricted to their name@business.com domain, if they choose.

1

The most secure approach, which you've probably figured out already, is to tie each invite to a specific address and not allow it to be used with another.

However, if you want to make things a little more user-friendly, then you could allow the invitee to use a different address, but don't allow any access to the shared content until the original inviter has approved the email address change. Something like:

The invitation that you sent to eric.businessman@business.com has been used to create a new account by ericb@popularmail.com. Allow access?

The inviter can then approve this change if they know that the two email addresses belong to the same person.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.