In a new ASP.NET MVC application I'm working on we'd like an administrator user to be able to set up other user accounts by creating invitations which will be emailed to the new user. That email will have a link that will take the user to a one-time page where they can either create a site login or elect to login with an OAuth provider (LinkedIn in our case).

I'm concerned with the potential security implications of such a process. The danger is that a user's email could be compromised and an account established by an attacker, thereby gaining access to the application.

These invitations may not be immediately acted upon, so an expiration window would have to be too long to be helpful. Because one user will be creating invitations for another, I also can't restrict based on the IP address.

Am I being paranoid here? Is there a more secure process to handle user creation by invitation?

(Cross-post of my Stackoverflow question.)

  • Well that's how invitation works, you invite email account, and you let the person. I dont see the issue, as you can issue security schema to each and restrict it's access on the start. Jul 20, 2012 at 19:26
  • There are some checks that you could implement: stackoverflow.com/questions/6912560/…
    – user27743
    Jun 28, 2013 at 14:58

1 Answer 1


It is up to the user to keep their email account secure. If it is compromised, it is their problem. There's no way to really solve the problem, other than ensuring that your site's authentication is good (see here for a guide) and that you have appropriate monitoring and moderation controls in place to deal with unscrupulous users.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .