Should the user be logged in when clicking on the verify email link?

  • I have a webapp with signp/signin
  • User does a signup with email password or a sign in via Google Twitter Facebook or GitHub
  • If user is new, then an email is sent to this user to verify their email account while they get redirected to the home page
  • This email contains a link like https://example.com/verify/4f476f1a9c861ddc3... a random token generated for that user and saved to database
  • The user may open the email immediately or may open it after a few hours
  • In say 24 hours, the link will expire
  • Should the user be logged in when clicking this link?
  • What should happen if the user is logged out?
  • Also when the user clicks verify email to generate a link? should a new token be generated each time? Is there a limit here to prevent getting attacked by some hacker?
Tags: , , , , , ,