JWT for email validation of an account

Question

I am thinking of using the this registration flow for my site:

1) User registers by entering email and password.

2) Enter the email and hashed password into my database

3) I then construct an email with my url + jwt (contains e-mail and expires in 1 hour) string as a parameter.

4) User receives email and clicks on link.

5) Link sent to my server where I parse the parameter and check if the jwt is expired.

6) If not expired I then take the email and mark the account as validated in my database.

Are there any obvious holes in this approach which would leave to big vulnerabilities?

Answer 1

For a typical email activation it should be okay, however for a password reset or an email confirmation which logs you in afterwards you usually want to ensure tokens are single use.

That ensures that a man-in-the-middle logging requests (ie. a corporate network administrator) can't follow the same link and log in after the legitimate user. Your expiry limits the window where this is a possibility though.

You also need to be careful with any other user input that you sign for other purposes. You want to ensure that a user couldn't exploit some other functionality by entering input that will generate a valid token for your email activation. You might like to include some random "action" string in your payload to ensure tokens generated for other purposed can't be used for email activation.