Would appreciate your opinion on the options explored:

a- Launch app and ask for a verification code that was sent to user email?

b- Launch app by clicking deep link + verification code in the email and confirm to user their email has been verified

Q1-From a information security point of what are advantages and disadvantages of both these approaches?

Q2- Any other considerations to take into account?

A more general question:

Q3- Given that mobile devises are frequently used to authenticate users would it be safe to say that mobile apps are less prone to authentication issues just by virtue of being on mobile?


Since this is about security, I would say regardless on how you do it, the security boils down to how many charachters that is suitable to use as "verification code".

However, using a single direct-activation link that is NOT a custom protocol registred as in the above comment, there is a risk that a unaware user clicks this links and inadvertly activates a account that the user did not register.

However, from a usability Point of view: Everyone does not have their email account tied to their phone, so a alternative must be used.

So my suggestion here is:

Have 2 alternatives, where the first alternative is a link like: appcustom://activate/39734962

But you also provide a secondary means of activating, that is like: "If you receive your email on a Another device than which the app is installed on, Press "Use Code" and enter 39734962 as code."

In the app, you must verify that the activation code corresponds to the same phone that initiated the activation. Eg: First user register with email. Server sends a unique token to app, that is saved on phone memory.

On server, you store email, token and activation code.

Upon activation, user enter code or click the custom protocol handler link. Your app then sends to server: Email, the token that was previously saved, and then code. Server checks all 3 fields match.

This would mean that if the user register, then delete the app from phone, and then reinstall the app, the user would be unable to activate using the activation code the user received. The user would have to request a new activation code.

A good idea is to kick off registration from this Point, so when user successfully has typed the activation code or clicked the link, the user is taken to the registration form to fill in the rest of the details, and where the email field is prefilled and not possible to change (of course you also need to check on server-side that the email field is not changed).

By using such a scheme, you avoid email adresses getting locked up because of malicious or unaware users.


1: User fills in Email and press submit.

2: Phone receives token from server. Phone saved email and token in memory.

3: User clicks protocol link in mail or enters the code in the app manually. App sends email, token and code to server. Server validates Email, token and activation code is correct.

4: User is now taken to the registration form where he is asked to fill in the rest of the details, like username, select a new password to use with account, first name, last name etc. Of course, the link and code in email must remain valid until the registration is actually completed, so if user accidentally abort the process (for example moves out of network coverage), they will be able to continue at a later time.

However, its a good idea to expire activation codes and tokens by time, for example 48 hours is a good time.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.