It's a common practice for websites to send email verification links on sign up. Should these verification links expire? I know about a bunch of website where they do and I wonder why?
asked Jan 16, 2013 at 11:50
-
There is a UX aspect to this problem, but please also see security.stackexchange.com/questions/29225/… and security.stackexchange.com/questions/197004/…– msanfordCommented Aug 15, 2019 at 13:14
-
Another (possibly security related) remark: You should think about invalidating old verification links, when the user decides to use another e-mail address.– alloCommented Feb 27, 2020 at 9:49
Add a comment
|
7 Answers
There isn't any major security reason behind them expiring. The main reason that this is done is to be able to clean up the database of old unused verification information.
From a UX side, some people argue that having a shorter verification time encourages people to verify sooner rather than later, but I haven't seen any evidence supporting that. It does however fit what I would expect in human behaviour.
-
1+1. This also allows to release unverified usernames, possibly because of an error during registration.– WtowerCommented Mar 4, 2023 at 10:04
If clicking the verification link automatically logs the user in, then yes, the verification link should expire.
Why? Because if the user's inbox is compromised a hacker can search for the verification email and then click the verification link to gain access to the user's profile on the website.
The question then is, when should the link expire. Maybe not immediately after clicking it, but for example 24 hours after the link has been clicked.
-
1What would be the purpose of letting a verification link stay active after the account has been verified? You can't (at least in normal cases) re-verify an account, so there wouldn't be any legitimate reason for a user to re-click a verification link.– michaelCommented Jan 26, 2016 at 0:29
-
it sounds like @bart is making the valid case that the website account has not yet been verified and the hacker gains access to the email account Commented Jan 26, 2016 at 6:17
-
2@michael Personal experience has shown that the verification link is often clicked more than just once. People probably click the link, open a browser and then get distracted and accidentally close the tab. They click the verification link again and then get hit with an error message saying the link is expired. To account for this scenario I think it's okay to allow the user to click the verification link more than just once.– bartCommented Jan 27, 2016 at 2:32
-
1I'm not arguing that verification links are clicked more than once; I fully agree users do that a lot I'm sure. More so the point I'm trying to make is the first time it's clicked, their account is verified, so at that point make further clicks simply redirect to the log in page or home page of the website. Definitely don't show an error as there's no point. For cases where the user has to take an additional step after clicking the link, if they get distracted and do something else, then their account wouldn't be verified, which means the link would still be valid.– michaelCommented Jan 27, 2016 at 4:16
-
@michael Fully agree that an additional click should not result in an error but just forward the user to whatever page. Unless of course the link is expired and the account hasn't been verified yet.– bartCommented Jan 28, 2016 at 0:55
This is a method to keep user database current. If an email is not verified until expiration time the corresponding user account is removed from the user database.
If you do not handle e-mail confirmation expiration, someone could register with someone else's e-mail address and never confirm it which would lock the e-mail of the legitimate user if he ever wants to register to your website.
If the user hasn't confirmed his e-mail address in the given length of time, you want to make it available again, in case it wasn't really his address or if he wants to register again later on. Consider the case where a user entered the wrong e-mail address by a mistake.
And while the true user with the email account can attempt to resend a verification email if the site allows for it, it would make a terrible experience for this back-and-forth.
answered Jan 26, 2016 at 6:12
An unaccepted invite that never expires is an unnecessary security risk. Perhaps it's not a security risk in a simple single-user application where the user/account/profile/etc.. doesn't exist until they sign up, but it definitely is a risk when it comes to accounts with multiple users or many applications where an account is setup on behalf of the user and may contain sensitive or private information (such as a login for a mortgage account). If the user never accepts the invite and an attacker later gains access to their email they can then gain access to the relevant account. Why bother leaving this attack vector open for users that aren't even using your software?! There isn't a one size fits all approach, but if there's any doubt I'd lean on the side of caution.
Someone might argue that once a user signs up if their email is compromised that the attacker could easily gain access to their account by changing their password. This is a separate issue and possibly a good reason to consider other security measures like two factor authentication.
If you do not need the expiration date in the email you should remove it. You should always strive to decrease friction for the user. Any information they do not need adds friction.
I went through this discussion just the other day and I'm questioning if anyone ever reads the whole message in a confirmation email in the first place.
The person who signed up most likely read a message after the sign up that they have to confirm their email and all they are doing now is trying to get access to their account. Most users are familiar with this process and will instantly click the link in the email and will never read the expiration date, and if they do they will probably ignore it.
-
My answer of course only applies if the confirmation email include the expiration date, which I assume it would. Commented Jan 16, 2013 at 14:49
If the link has expired, I think the user should first be taken to an informative page letting them know that the link has expired and then asked to log in to take them to the respective flow.
If the user is authentic, it gives them a good idea of what happened, leading to a good way to find design principle.
