How long should an e-mail address confirmation link last and why must it expire at all?

Question

After a user registers an e-mail is sent to them with a link they must click on to activate the account. I know other sites have a limit on the amount of time the user has to click the link, else the link expires. Come to think of it why is this necessary? Is it to prevent an attacker from creating accounts to which he does not own the registered e-mail because he could generate an arbitrarily large amount of accounts and have unlimited time to guess activation links to them?

If it is necessary, how long should the user have to click on the link?

Answer 1

Most websites allow an e-mail address to be used only for one account which makes sense because most of the time, users only need one account. Therefore, a unique e-mail address is required.

That being said, once the user has registered but only needs to confirm his e-mail address, you want to insert in the database the e-mail address of the user to not allow someone else or the very same person to register again. If you do not handle e-mail confirmation expiration, someone could register with someone else's e-mail address and never confirm it which would lock the e-mail of the legitimate user if he ever wants to register to your website.

If the user hasn't confirmed his e-mail address in the given length of time, you want to make it available again, in case it wasn't really his address or if he wants to register again later on. Consider the case where a user entered the wrong e-mail address by a mistake.

Now for the right length of time, I'd say that it depends on the type of website it is. I don't see the point of allowing more than a few hours because the user should be able to quickly access his e-mail address if he was able to register to your website. Consider the case where a user forgot his e-mail address password and can't access it. He might need to go through some steps to get his password back which could take a while. However, would it really do harm if he has to register again? Once again, it depends on the website.

Answer 2

Taking resource exhaustion attacks out of the equation, there's no reason you should have to expire those links.

That said, you should think about how 99% of users are going to use your site and optimize for that. It's going to be rare that someone is going to find an 18 month old activation link in their inbox AND remember your site AND still find it useful AND click on that link.

With activation links or codes that last forever, you have to keep them forever. If you have a popular site that could be a lot of rows in your DB.

What's the worse case scenario if you expire those links after 10 days and they have to click the "create account" again?

By the way, blocking activation for a user B because user A already used their email address (either mistakenly or maliciously) is a very poor experience. It's not about who gets there first, it's about who actually owns the email account.

Answer 3

I agree with this answer (+1). Most of the sites need to have a 'Resend verification email' functionality because original email can be lost en-route or blocked by a spam filter. This means that, contrary to the most upvoted answer, no one can lock my email out because I can always resend verification email to my address. So the only real reason for verification links to expire is storage resources: we want to remove unverified accounts (links) to avoid storage growing indefinitely or slowing down. So we need a sensible way to remove 'expired' unverified accounts (say 48 hours since the last verification email has been sent).