In a web application, is there a security advantage to forcing a newly registered user to manually log into their account, or is it safe to automatically log in a new registration? Assume that the user is registering using a local registration/login strategy, and their credentials are an email address and password they specified at the time of registration.
This is a perfectly reasonable thing to do.
If you don't require a user to verify their e-mail address before using your service (or perhaps you only require a username and password to sign up in the first place), then granting a user a session upon completing registration is a reasonable thing to do.
However, if you require the user to verify their e-mail address first, then you should only grant a new session upon verification, not upon sign-up.
Allowing the user to log in automatically upon account creation, is one thing. What he can do during his session is another thing.
That said, automatically log in a new registration is widely adopted on the Internet, however depending on your requirements, you might restrict him from accessing some features until he confirms his email.