When you ned to confirm that an email address belongs to a certain visitor to your site, would it be insecure to do it as follows:

  • When the user visits your site, you give them a session token as a cookie, and send them a confirmation email
  • Within the email is an image, hosted by your site.
  • The mail also contains a confirmation link, with the message 'if you don't see an image, please click the link below.
  • When the browser sends a request for the image, you check if the request contains the cookie you gave before sending the confirmation email, and if there is such a cookie, send back the image.

This makes it easy to confirm your e-mail address without clicking a link in the e-mail.

Just like any other email confirmation system, there is still also some token in the confirmation link, or the image source.

so, is this still secure?

  • The simple answer is no - it is not secure. However it may be secure enough for your purpose.
    – Rory Alsop
    Commented Oct 4, 2013 at 12:20
  • It also assumes a web-based email client, which you're accessing using the same browser as the sign-up page. Use Thunderbird (or be checking your secondary email in an Incognito window), and this will simply fail.
    – cloudfeet
    Commented Oct 4, 2013 at 16:01
  • that's why I'd provide the link as a fallback.
    – bigblind
    Commented Oct 4, 2013 at 21:19

1 Answer 1


Ah, but the user is "clicking a link in the email". It just is an "automated click". The danger in "clicking a link in the email" does not come from the physical action of pushing the button, but from the downloading of data from a link found in the email. If this downloading occurs automatically, the risk is not reduced; quite the contrary, in fact. Most emailing software offer, at least as an option, a possibility not to automatically download pictures; this is an improvement because it, at least, gives a way for the user to prevent the download to occur (namely, by not clicking).

In that sense, your proposal is equivalent to a click-in-email system, and shares the same security issues. At best, it improves user experience, in that it removes the physical click in the cases where the user is careless (i.e. his software follows image links automatically). To some extent, what you suggest boils down to: "yeah, user is vulnerable, but at least we can leverage his vulnerability to make his life easier; he cannot be protected, but let's fill his world with blissful ignorance instead of dread".

Now, if you take the server's point of view, the system indeed guarantees that whoever received the cookie in his Web browser is also able to read the emails sent to the specified address, since the browser followed the image link from the email. You should still make sure that the link in the email contains a non-guessable random component; otherwise, an attacker could simply get the picture by typing the link in his browser, thus simulating reception of the email. As usual, even the best security systems contain enough room to totally botch them, if implemented without due care.

  • I was thinking about security from the view of user identity. So, when a user registers from the site, you want to make sure that the user is actually the owner of the e-mail address. The image makes this more seamless for the user, I just wanted to make sure that the user not having to click the link anymore wouldn't create a security risk.
    – bigblind
    Commented Oct 4, 2013 at 14:18
  • 1
    Well, you don't create an additional risk. But the image makes things more "seamless" only if the risk is already there.
    – Tom Leek
    Commented Oct 4, 2013 at 14:28
  • I disagree a bit. From the privacy point of view loading the image is a big risk. From the security point of view clicking a link is a risk as it may lead to a phishing site. But the model in the question does not include the security risk and would work when the user accepts the privacy risk by loading images in mails (from the website) in their webmail. A phishing mail would just load a image which does not have any effect without the right token/cookie.
    – allo
    Commented Dec 22, 2017 at 13:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .