2

In a web application, is there a security advantage to forcing a newly registered user to manually log into their account, or is it safe to automatically log in a new registration? Assume that the user is registering using a local registration/login strategy, and their credentials are an email address and password they specified at the time of registration.

4
  • Depends on the app. For example, medical and banking apps have a different risk profile and thus may require a login after account creation. This may not be the case for a website sharing the latest funny pic.
    – phbits
    Nov 17, 2020 at 21:08
  • @phbits what would be the technical justification for the high risk profile cases? Is there an attack vector created by creating a login session at registration? Assume that we're doing some sort of person verification at registration, so email verification is unnecessary.
    – the8thbit
    Nov 17, 2020 at 21:17
  • It would give your users the opportunity to save their login in their password manager or browser.... So they won't have to add it manually, or log out and then in again to save it...
    – svin83
    Nov 17, 2020 at 23:22
  • @the8thbit - the account creation code would need to have the ability to generate sessions. This increase in attack surface may guide higher risk apps to isolate the account creation process; requiring the login separately.
    – phbits
    Nov 18, 2020 at 5:12

2 Answers 2

1

This is a perfectly reasonable thing to do.

If you don't require a user to verify their e-mail address before using your service (or perhaps you only require a username and password to sign up in the first place), then granting a user a session upon completing registration is a reasonable thing to do.

However, if you require the user to verify their e-mail address first, then you should only grant a new session upon verification, not upon sign-up.

0

Allowing the user to log in automatically upon account creation, is one thing. What he can do during his session is another thing.
That said, automatically log in a new registration is widely adopted on the Internet, however depending on your requirements, you might restrict him from accessing some features until he confirms his email.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.