Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
When users triggers email change, we send a link to their new email address.
If user follows the link, should we only proceed with email change after authorization (being logged in the site), or we can just change the email like in the password reset flow?
We'd probably have to add a CTA button (perhaps reCaptcha) to prevent email link sniffers.
What other security implications could there be in the no-auth scenario?
If you do not have an authorisation step in the confirmation, then if the user mistypes the email and an unauthorised person gets the link and confirms, then the unauthorised person can gain full access to the account through the "forgot password" function.
This happens to me all the time. People use my email address by mistake when signing up for things. I can confirm the email, and then could then reset their password.
You would think that the user would notice, but I get a dozen emails a day destined for other people who have not realised that a service is sending me their info. (I can't make a change on my own because that would mean gaining unauthorised access to the user's account).
