Implementing an invitation process for user setup

Question

In a new ASP.NET MVC application I'm working on we'd like an administrator user to be able to set up other user accounts by creating invitations which will be emailed to the new user. That email will have a link that will take the user to a one-time page where they can either create a site login or elect to login with an OAuth provider (LinkedIn in our case).

I'm concerned with the potential security implications of such a process. The danger is that a user's email could be compromised and an account established by an attacker, thereby gaining access to the application.

These invitations may not be immediately acted upon, so an expiration window would have to be too long to be helpful. Because one user will be creating invitations for another, I also can't restrict based on the IP address.

Am I being paranoid here? Is there a more secure process to handle user creation by invitation?

(Cross-post of my Stackoverflow question.)

Answer 1

It is up to the user to keep their email account secure. If it is compromised, it is their problem. There's no way to really solve the problem, other than ensuring that your site's authentication is good (see here for a guide) and that you have appropriate monitoring and moderation controls in place to deal with unscrupulous users.