0

Let's say I have a SaaS platform, like a B2B platform where there are company accounts.

In this platform users can invite other users to join the company account by sending them an invitation link in an email with a secure token (à la Google Drive or GitHub).

Should we then let the invited user subscribe using a different email from the one where they received the invitation ?

That question regards primarily UX experience, although some security concerns might also be raised (I couldn't find a more appropriate site for that kind of questions).

4
  • So from the UX point of view, your question is: Should you allow user to do what they want to without you interfering their doings? Commented Nov 13, 2019 at 15:01
  • @locationunknown Well, the other UX-focused outcome to consider might be how frustrating/dangerous it might be for someone to intercept that token and commandeer your invite. Commented Nov 13, 2019 at 15:10
  • @locationunknown Except after rereading it, it sounds like more of just an "invite others to join!" that happens to have a unique ID. The one inviting may not know the email address that the invitee would like to use for their account (and should not care). So I'm with you now. (I'll write up an answer if you don't get around to it first.) Commented Nov 13, 2019 at 15:13
  • @maxathousand it's no "invite to join" its more "invite to join and give access", like if you invite someone to join your organization on GitHub for instance (so there is a privilege/access granted by the invitation)
    – Weier
    Commented Nov 13, 2019 at 15:28

2 Answers 2

1

Tie the invitation to a specific email address.

As you mentioned, this is invite code grants permissions to your service, so it should be handled carefully, perhaps even on the level of a password reset link, where it expires after a period of time.

Businesses typically issue their own email addresses to their clients, so there will likely be no question of which email address an invited user would like to use. By tying it to an email address, the "Inviter" can strictly control which email addresses have access, and ensure that account access can be restricted to their [email protected] domain, if they choose.

1

The most secure approach, which you've probably figured out already, is to tie each invite to a specific address and not allow it to be used with another.

However, if you want to make things a little more user-friendly, then you could allow the invitee to use a different address, but don't allow any access to the shared content until the original inviter has approved the email address change. Something like:

The invitation that you sent to [email protected] has been used to create a new account by [email protected]. Allow access?

The inviter can then approve this change if they know that the two email addresses belong to the same person.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.