When signing up for a new account with a web application, it is standard to send a validation email. I don't want to go into the pros and cons of the validation email though.
When receiving a validation email and following the validation link, an application will typically show some screen letting you know that your email address has been validated. At that point there are one of two options.
- Let the person sign into the application with their username & password (or some such combination).
- Automatically sign the person into the application with the appropriate account and let them start doing whatever it is that you do with the application.
Option 1 appears better security wise, while option 2 gives the person less to do - better UX wise.
When does it justify making a security tradeoff (option 2) for a better initial user experience?