Log User In Automatically After Clicking Account Activation Email

Question

Scenario: Forum account registrations, user must click an activation email after they sign up e.g. they create an account with username, email, password, and an email is sent to the email they select. They must click it to "activate" the account.

Lets assume that all steps up to the clicking of the email are secure for the use case/purpose of the site.

I understand that the users email account could be compromised, but this is not in our control.

What security issues are present in the scenario that we auto-log the user in when they click the activation link in the email (and activation is successful)?

I have read the answers in the question Logging in a user after password reset via link, and it seems the strongest reason for NOT auto-logging the user in would be those mentioned by Tom Leek e.g. user not knowing they are logged in automatically, and potentially leaving the device unattended with an authenticated session still open, etc.

Answer 1

For many sites the model is that an accounts are controlled by anyone that has the password or has control over the email account. An auto-login is just an extension of that model. The link should only be available to that email account and that email account should only be available to the account holder.

That said, SMTP is a pretty bad channel to rely on for secrecy. Your message will move over networks in the clear and bounce through multiple mail servers where it could be stored. Additionally the activation link might be processed by a proxy where it gets stored in the logs. You might decide that you trust email enough for the verification step but not for authentication or password reset.

You could try a hybrid approach where you get the benefits of auto-login and minimize those security risks. When the user creates an account you create a session for them in a probationary state. You know who they are but you don't let them access any features. Once they activate you change their state from probationary to active and they can access features. Just having the link will no longer get you access to the site.

If you do follow your proposed model you should time-bound the auto-login token, make it appropriately hard to guess and verify that the activation token matches the user account. You don't want people guessing tokens and getting access to your user accounts.

Answer 2

Another problem is login csrf. Some researchers say it is a low priority issue but some say it is not. Login csrf is a vulnerability in which an attacker logs in with his account in a victims computer. Consider a hacker add the activation link into SRC of an IMG tag and send to victim. Upon viewing the page be logs in as the attacker and he can track the user activity.