3

Scenario: Forum account registrations, user must click an activation email after they sign up e.g. they create an account with username, email, password, and an email is sent to the email they select. They must click it to "activate" the account.

Lets assume that all steps up to the clicking of the email are secure for the use case/purpose of the site.

I understand that the users email account could be compromised, but this is not in our control.

What security issues are present in the scenario that we auto-log the user in when they click the activation link in the email (and activation is successful)?

I have read the answers in the question Logging in a user after password reset via link, and it seems the strongest reason for NOT auto-logging the user in would be those mentioned by Tom Leek e.g. user not knowing they are logged in automatically, and potentially leaving the device unattended with an authenticated session still open, etc.

1
  • The securest thing to do here, is to just ask for the email adress + perhaps a captcha, send a link to that, that authorizes the email adress (email adress + a MAC that authorizes that particular email). Then the signup continues with the email adress verified, eg ask for username, password etc. Nothing in the database needs to be created Before the step2 in account Creation is completed. This solves all security problems. – sebastian nielsen Nov 6 '15 at 21:25
3

For many sites the model is that an accounts are controlled by anyone that has the password or has control over the email account. An auto-login is just an extension of that model. The link should only be available to that email account and that email account should only be available to the account holder.

That said, SMTP is a pretty bad channel to rely on for secrecy. Your message will move over networks in the clear and bounce through multiple mail servers where it could be stored. Additionally the activation link might be processed by a proxy where it gets stored in the logs. You might decide that you trust email enough for the verification step but not for authentication or password reset.

You could try a hybrid approach where you get the benefits of auto-login and minimize those security risks. When the user creates an account you create a session for them in a probationary state. You know who they are but you don't let them access any features. Once they activate you change their state from probationary to active and they can access features. Just having the link will no longer get you access to the site.

If you do follow your proposed model you should time-bound the auto-login token, make it appropriately hard to guess and verify that the activation token matches the user account. You don't want people guessing tokens and getting access to your user accounts.

1
  • You are wrong about SMTP in the clear there. I did a runthrough on my email account running from my own TLS capable SMTP server with DANE, and about 70-80 % of the mails are sent encrypted, as per the received line from my server. – sebastian nielsen Nov 6 '15 at 21:14
2

Another problem is login csrf. Some researchers say it is a low priority issue but some say it is not. Login csrf is a vulnerability in which an attacker logs in with his account in a victims computer. Consider a hacker add the activation link into SRC of an IMG tag and send to victim. Upon viewing the page be logs in as the attacker and he can track the user activity.

3
  • A traditional login form can be CSRF'd as well. If the form processor accepts GET requests you could include credentials in the URL and if it only accepts POST you could do something in a hidden iframe. – u2702 Nov 6 '15 at 16:32
  • It's just another way for login csrf even if the login page has anti csrf tokens – haseeb Nov 6 '15 at 16:34
  • The activation link is only good for the single click (whether or not the activation is successful). I think this would mitigate the issue you described here, correct? – GWR May 29 '18 at 12:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.