Sign in a user or not after they verify email address?

Question

So in a typical web-app scenario, the new user is sent some sort of email with a one-time, time sensitive token link which when clicked will "activate" their account or "verify" their email address.

Question:

Do we, or do we not also sign that user in (set bearer token; send auth/session cookie) at the time when we verify them via the unique link?

For clarity: assuming, no previous session in the browser where the activation link is clicked:

• If we do create a session/sign the user in, then the user is free to navigate back to the home page and throughout the app and they are not required to enter their username/password.
• If we do not create a session/sign the user in, then their account is still activated (or email verified) but any attempt to navigate into the app presents the login form and continuation requires username and password.

Answer 1

In terms of the technology, if the account is anything more than a validated email address, then it has a greater asset value than the email containing the activation token (e.g. might provide access to apply for credit, or expose supplementary information captured during registration, ability to send emails from an address). Since you can't really assure the integrity of the registration confirmation email delivery I would say that you need to ask the user to login - which then proves they are the registered identity. Of course this has very little value of you also offer a password reset via email.

A further consideration is that you encouraging the user to repeat the login process, reinforcing the difficult-to-guess thing which is often difficult-to-remember.

The downside is that it something of an inconvenience for users.

Answer 2

I think it depends on the application. I have been involved in the development of many (web)applications and how you deal with login, logout, activate and password reset is revised per application. If you to make the signup as easy as possible, then create a session on activation. Then you might want to show a message confirming account activation.

On the other hand, some mail clients (Outlook for Android) , proxies and firewalls follow the links in an mail. If you let the user login directly the activation and login could be triggered without the users knowledge. At some later moment when the users decides to activate the account, the link is not valid anymore. You can fix this in many ways.

Personally I prefer the first option, activation and login at once.

From a security perspective, I am not sure it it matters much. Of course anyone with the link can access the account, but at that point the account it's still empty. It all depends on the use case.