Whats the point of this?
> Email verification links should not provide the user with an authenticated session.
It always bugs me. The "forgot password" links only allows me to choose a new password, but does not log me, adding a extra step.
> Email verification links should not provide the user with an authenticated session.
It always bugs me. The "forgot password" links only allows me to choose a new password, but does not log me, adding a extra step.
However, the price for not doing this is pretty high in terms of conversion, so as far as I'm concerned it's not a black and white issue.
If there's nothing particularly sensitive to be compromised (and that usually isn't the case at this stage), simple measures like rapidly expiring the verification URL and allowing it to be used only once is "good enough" for most sites.
There are no absolutes in security.
Aren't both of these equivalent though?
(I would think the point may be that a compromised email, doesn't provide access later. Both these scenario are equally vulnerable then?)