So presuming a username/password authentication system (not an SSO) if you register a new user, what's the disadvantage of logging them in before verifying their account by email?
Let's presume that by logging them in they won't have access to sensitive content, or the ability to do something like charge a credit card.
Most software I've encountered does. "click register" -> "fill form" -> "send email" -> "activate account" (sometimes allowing concurrent login) -> login.
what I'm trying to figure out is if there's a security hole from basically taking a login form (you gave me a username/password) "click register" -> (account is created and you're logged in); or "click register" -> "fill form" -> "confirm and log in".
Obviously there are user experience advantages/disadvantages, but I've been trying to figure out if there are security implications of doing this. The only only security implication I can think of are SPAM accounts which is where someone is creating users automatically.
I'm just trying to ensure that I'm not making some mistake like not using a nonce in a password reset link (unrelated). Like maybe there's something security related that I don't know that I don't know.