I am working on a system where the administrator can configure the following behaviour for email addresses:

  • Allow users to attach multiple email addresses to their account (just like Facebook and Linkedin).
  • Only allow 1 email to be attached to each account.

As email addresses are used to log into the system, ensuring that users have the entered the correct email address is very important. We do this by sending them an email with a link to confirm the email address if they add a new email address or change their email address.. This has to be done before that email address can be interacted with/used on the site.

The question is: Once the user clicks the link in the email, should we automatically log them in, or should we force them to enter their email address and password to login? This is assuming that the user is not logged into the site yet.

Are there any preceived and actual security implications of automatic logging in the user on confirmation of the address?

  • Why don't you relate a link with an action only? That way, a link would be provided with a permission to perform particular action while not easing the security policy. Also, I am not sure, but I feel like different users would have different expectations. People with small technical knowledge would probably like an autologin feature, but more technically advanced users would probably share a security concerns with you. Who are your users? Oct 1, 2012 at 9:15
  • If you want to know about the security implications it would be better to ask the question over at security.stackexchange.com
    – Christian
    Jan 2, 2017 at 15:39

2 Answers 2


If you are confident that the only way that the email was triggered was as a result of an action of a logged in admin user, then you should be OK. Not requiring another log-in is a better experience, unless the site contains highly sensitive information and/or the admin would feel better and, therefore, perceive greater security in having to log in again.


Why not let the users decide themselves? Offer a "log me in now" button on the confirmation page, and they can choose whether they just wanted to quickly confirm the address or go on and use the website.

  • 2
    I feel that having a gateway page like that would introduce extra unneeded complexity over a pretty trivial process in the workflow. Of course, I could be wrong :)
    – F21
    Sep 30, 2012 at 11:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.