One mechanism for inviting a user to join a community in which private, personal information is to be shared is to generate a time-bombed (5-15 minutes) confirmation link with a string generated with a secure random number generator and email an invitation message to the invitee with this link. For example:
Hello! You've been invited by ____ to join ___. Visit mysite.example.com/confirm/Ip10QEUECfkw2XFTSvzt88oj to join.
I can implement this by generating the link server side and sending the email server side. The link in this case is never exposed to the sender, ever, and is only (1) stored in the invitations table in the database, and (2) appears in the email, sent by the server (Amazon SES for example).
My question is: can a client securely send this email with its native email client? I've been told a lot of systems do this, and that the invitation email, with the secure link exposed, goes into the "Sent Items" folder on the client's email app! This strikes me as bad because it seems that client-generated links that the server has to know about expose too much. Why not take the sender out of the picture completely?
Is the generation of an invitation using a native client email okay? Seems it relies entirely on the expiration of the link for security. Is this an acceptable trade off of security for convenience? If it is not okay, why do folks do this?