When users triggers email change, we send a link to their new email address.

If user follows the link, should we only proceed with email change after authorization (being logged in the site), or we can just change the email like in the password reset flow?

We'd probably have to add a CTA button (perhaps reCaptcha) to prevent email link sniffers.

What other security implications could there be in the no-auth scenario?

  • 1
    Can you trigger the email change only after authentication? – schroeder Nov 7 '18 at 17:29
  • @schroeder Yes, user has to re-enter their password when triggering the change. – Mārtiņš Briedis Nov 7 '18 at 23:10

If you do not have an authorisation step in the confirmation, then if the user mistypes the email and an unauthorised person gets the link and confirms, then the unauthorised person can gain full access to the account through the "forgot password" function.

This happens to me all the time. People use my email address by mistake when signing up for things. I can confirm the email, and then could then reset their password.

You would think that the user would notice, but I get a dozen emails a day destined for other people who have not realised that a service is sending me their info. (I can't make a change on my own because that would mean gaining unauthorised access to the user's account).

  • Yes, mistyped password could be a factor! Thanks, never thought of that. Probably will have to add another email confirmation field when triggering the change. Users currently can still cancel the change from their account, which would then invalidate the email sent. This would be a problem if the non-inteded person would quickly confirm the change though. – Mārtiņš Briedis Nov 7 '18 at 23:13
  • 1
    just a re-auth after the link is hit should do fine – schroeder Nov 7 '18 at 23:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.