Should general 404 page be shown to the user if he clicks one-time link second time?

Question

There is a Sign up function in a web application. After user signs up, an email message with confirmation link is sent to his email address. This confirmation link is obviously valid only one time.

Which page should be shown to the user when he clicks that one-time link second time:

• a general 404 page with text "This page doesn't exist"
• Home page with general error message "You've followed a link that is valid only one time"
• Home page with specific error message "You've already confirmed your email address"?

Does it really matter from user's point of view?

Answer 1

The address confirmation may only be valid as a confirmation one time, but that doesn't mean that you have to have no knowledge of it once it has been used. You could store confirmation links for a period of time (say a month), and if someone tries to use it again in that period of time, you would show them a page explaining that the email address (and show them the address) has already been confirmed. That way you are showing them useful information and not just an error.

The address [email protected] has already been confirmed. If you would like to change your email address in your account please sign in.

Then if you use a structured url for confirmations, even once you have deleted the confirmation code from your database, you will still know that they are trying to confirm an address. For example, if the URL structure were mydomain.com/confirm/some-code-here you could always show a generic message page stating that the confirmation code has already been used or expired

The confirmation link has already been used or expired. Why don't you sign in to your account and blah blah blah.

In general, if you have a way of giving constructive information, you should do that rather than throw a generic error page.

Answer 2

General 404 would be misleading.

I would display a page with information that his/her address has already been confirmed or the confirmation link is invalid (just to prevent an unintended person who gets access to the confirmation link to extract information if the account has been confirmed). This means a custom 404 for confirmation links.

Answer 3

I would say it matters, and the more detailed the error message is the better. 404 would be the worst as it suggests a problem that does not exist. A message stating "You have have already completed this action" would be best, for a sign up or email confirmation links to resend a password or registration confirmation would be good too.