I'm working on authentication on the backend of an application and I want to know which of the following methods is the best.

After the user registers in the application an email is sent to the registered email with an OTP code to confirm the email address. Then the user has to input the OTP code followed by the password and confirmation password.

Now, after validating the OTP and the password, should I redirect the user to the login page to log in normally, or generate a JWT token and auto-log him in?

  • Do I understand you correctly that the "user registers in the application" does not involve setting a password at all but that the password is only set during the process of email/OTP code confirmation? I don't see any security advantage of then asking the user yet again immediately for the password by forcing a new login - this is mostly annoying for the user. I'm not sure if it is a good idea to delay choosing a until password after email verification, but that is a different topic. Dec 1, 2023 at 19:07


You must log in to answer this question.

Browse other questions tagged .