When users verify their email address successfully, could I just log them in automatically?
I consider the following reasons to do so:
- The link is a random hash
- Users will already be annoyed by having to validate
- I will trust anybody who has access to the email inbox anyway, since you can reset your password
- Users can of course only validate (and therefore autologin) once
I am asking because sending a link that logs you in automatically makes me feel like I am missing something.