In a new ASP.NET MVC application I'm working on we'd like an administrator user to be able to set up other user accounts by creating invitations which will be emailed to the new user. That email will have a link that will take the user to a one-time page where they can either create a site login or elect to login with an OAuth provider (LinkedIn in our case).

I'm concerned with the potential security implications of such a process. The danger is that a user's email could be compromised and an account established by an attacker, thereby gaining access to the application.

These invitations may not be immediately acted upon, so an expiration window would have to be too long to be helpful. Because one user will be creating invitations for another, I also can't restrict based on the IP address.

Am I being paranoid here? Is there a more secure process to handle user creation by invitation?

(Cross-post of my Stackoverflow question.)

  • Well that's how invitation works, you invite email account, and you let the person. I dont see the issue, as you can issue security schema to each and restrict it's access on the start. – Andrew Smith Jul 20 '12 at 19:26
  • There are some checks that you could implement: stackoverflow.com/questions/6912560/… – user27743 Jun 28 '13 at 14:58

It is up to the user to keep their email account secure. If it is compromised, it is their problem. There's no way to really solve the problem, other than ensuring that your site's authentication is good (see here for a guide) and that you have appropriate monitoring and moderation controls in place to deal with unscrupulous users.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.