Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

In a new ASP.NET MVC application I'm working on we'd like an administrator user to be able to set up other user accounts by creating invitations which will be emailed to the new user. That email will have a link that will take the user to a one-time page where they can either create a site login or elect to login with an OAuth provider (LinkedIn in our case).

I'm concerned with the potential security implications of such a process. The danger is that a user's email could be compromised and an account established by an attacker, thereby gaining access to the application.

These invitations may not be immediately acted upon, so an expiration window would have to be too long to be helpful. Because one user will be creating invitations for another, I also can't restrict based on the IP address.

Am I being paranoid here? Is there a more secure process to handle user creation by invitation?

(Cross-post of my Stackoverflow question.)

share|improve this question
    
Well that's how invitation works, you invite email account, and you let the person. I dont see the issue, as you can issue security schema to each and restrict it's access on the start. –  Andrew Smith Jul 20 '12 at 19:26
    
There are some checks that you could implement: stackoverflow.com/questions/6912560/… –  user27743 Jun 28 '13 at 14:58
add comment

1 Answer

It is up to the user to keep their email account secure. If it is compromised, it is their problem. There's no way to really solve the problem, other than ensuring that your site's authentication is good (see here for a guide) and that you have appropriate monitoring and moderation controls in place to deal with unscrupulous users.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.