I have a website that lets users submit a form without having to create an account and log in. However, in order to keep users accountable for their submissions, the form requires them to provide their school-issued email address (which follows a known, constant pattern and can be used to derive the user's real name).
The process currently looks like this:
- The user submits a form with his email address and the main content he wants to submit. Both are stored on the server.
- The site sends a confirmation email to the user at the address provided in the form submission.
- The user clicks the confirmation link in the email, signaling the application to process the form's main content. (If the link is not clicked within a certain timeframe, the form's main content is purged from the server.)
Over time, this may grow inconvenient for frequent visitors. I would like to implement a "remember me" checkbox that caches the user's confirmation. With this implemented, after successfully confirming a submission once, subsequent submissions within a given timeframe would not require email confirmation at all.
The top priority is that users must not be allowed to submit things in each other's names. I don't want to implement this convenience unless I know it can be done without violating that priority. Can this be securely pulled off? If so, how?