Should the user be logged in when clicking on the verify email link?

Question

• I have a webapp with signp/signin
• User does a signup with email password or a sign in via Google Twitter Facebook or GitHub
• If user is new, then an email is sent to this user to verify their email account while they get redirected to the home page
• This email contains a link like https://example.com/verify/4f476f1a9c861ddc3... a random token generated for that user and saved to database
• The user may open the email immediately or may open it after a few hours
• In say 24 hours, the link will expire
• Should the user be logged in when clicking this link?
• What should happen if the user is logged out?
• Also when the user clicks verify email to generate a link? should a new token be generated each time? Is there a limit here to prevent getting attacked by some hacker?

Answer 1

Even time expiration limit not necessary for each application usecase, there is not much difference when a user is logged in or out within this frame.

• Simply first, it should be checked if user already logged in and if not, user should asked to complete login informations which prompted before redirecting the user to verification grant. That means not necessarily user has to be signed in during clicking this link.
• And as I mentioned above, you should first force users to sign in to be able to grant their verifications.
• For your third question "Also when the user clicks verify email to generate a link?", since you clarified the situtation with a
  comment below, then you may automatically send a verification e-mail without any further action by user right after the account is created (means signed up). Plus, you may give your users ability to view
  re-send option within the same area instead of letting them send first time, since it's necessary for every user.
• For the rest of this question, I'll share my opinions other than experience since I haven't done a complete system like you described above. I can think of generating a single token valid for 24 hours even generating a token therefore a link is not so complex. Letting users be able to send this verification a reasonable amount of time (to say, a couple of times for each day) satisfy my point of view in ideation.
• By this way, while you may limit the verification request to say 3 times a day, you encounter the attacking probability and save your resources. For the users can't still get a verification mail, you may try to include SMS technologies or some other alternative ways to grant access.

Answer 2

I have seen a common scenario is:

1. User clicks link in their Email
2. A tab in their browser opens, with some text like "Account Successfully Activated".

And that's it, the screen stays in there with the message. It does not redirect to the website. Slack, Zoom and other services to this. Or at least they acknowledge that they will redirect the user, but the user needs to click a button to advance.

Consider that some users have disabilities and it might take a while for them to read your message, so it might be confusing if you redirect them without their permission.

• About token generation, you should limit it after X tries in Y minutes.