1

On occasion we want to create a user account for important users who we've been in touch with in advance.

When they then visit our site, the ideal UX scenario is that they complete a third party form (generated by HelloSign) first, and change their password second.

Is there a good way to do this? I looked at eg this thread on sending an initial password via email, which is the solution that first occurred to me. The top-voted response recommends against the practice in favour of getting a log in/reset link, but as far as I understand, the point of doing it via token would be to prevent any other activity before the password has been changed. Is there any secure alternative?

Improve this question
4

1 Answer 1

Reset to default
4

I'd recommend that you do the following:

Once you receive their submission, create their account and set up a random password for the password field. Then send them a password reset link that'll also double up as a email verification link. From there, log them in normally.

Improve this answer
2
  • and since they won't be logging in using that random password, please by all means make it a very strong, very random, very long disposable password.
    – Mindwin Remember Monica
    Jan 30, 2017 at 14:19
  • @Mindwin Agreed. Just a random hash to block them
    – thel3l
    Jan 30, 2017 at 15:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .