• I have a webapp with signp/signin
  • User does a signup with email password or a sign in via Google Twitter Facebook or GitHub
  • If user is new, then an email is sent to this user to verify their email account while they get redirected to the home page
  • This email contains a link like https://example.com/verify/4f476f1a9c861ddc3... a random token generated for that user and saved to database
  • The user may open the email immediately or may open it after a few hours
  • In say 24 hours, the link will expire
  • Should the user be logged in when clicking this link?
  • What should happen if the user is logged out?
  • Also when the user clicks verify email to generate a link? should a new token be generated each time? Is there a limit here to prevent getting attacked by some hacker?

2 Answers 2


Even time expiration limit not necessary for each application usecase, there is not much difference when a user is logged in or out within this frame.

  • Simply first, it should be checked if user already logged in and if not, user should asked to complete login informations which prompted before redirecting the user to verification grant. That means not necessarily user has to be signed in during clicking this link.
  • And as I mentioned above, you should first force users to sign in to be able to grant their verifications.
  • For your third question "Also when the user clicks verify email to generate a link?", since you clarified the situtation with a
    comment below, then you may automatically send a verification e-mail without any further action by user right after the account is created (means signed up). Plus, you may give your users ability to view
    re-send option within the same area instead of letting them send first time, since it's necessary for every user.
  • For the rest of this question, I'll share my opinions other than experience since I haven't done a complete system like you described above. I can think of generating a single token valid for 24 hours even generating a token therefore a link is not so complex. Letting users be able to send this verification a reasonable amount of time (to say, a couple of times for each day) satisfy my point of view in ideation.
  • By this way, while you may limit the verification request to say 3 times a day, you encounter the attacking probability and save your resources. For the users can't still get a verification mail, you may try to include SMS technologies or some other alternative ways to grant access.
  • i plan to add a monthly subscription payment gateway to my website so email verification would be essential to bill
    – PirateApp
    Commented Jul 11, 2020 at 3:46
  • 1
    I edited my answer as above. Commented Jul 13, 2020 at 12:04

I have seen a common scenario is:

  1. User clicks link in their Email
  2. A tab in their browser opens, with some text like "Account Successfully Activated".

And that's it, the screen stays in there with the message. It does not redirect to the website. Slack, Zoom and other services to this. Or at least they acknowledge that they will redirect the user, but the user needs to click a button to advance.

Consider that some users have disabilities and it might take a while for them to read your message, so it might be confusing if you redirect them without their permission.

  • About token generation, you should limit it after X tries in Y minutes.
  • what happens when you click that link in that email and user is logged out on that website?
    – PirateApp
    Commented Jul 15, 2020 at 2:40
  • @PirateApp: Some websites leave the user logged out, it just acknowledges that the account has been activated. It might help to create a user flow to visualize all possible scenarios.
    – sog
    Commented Dec 26, 2020 at 22:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.