How do I resemble the typical "confirmation of account" procedure seen in multiple websites?

Question

I want to resemble the typical "confirmation of account" procedure seen in multiple websites. When a user registers an email is sent to him with a confirmation link. Once the user goes to that confirmation link its account gets confirmed. Don't worry about the email sending process. The thing is that I need to generate a URL to which the user can then enter to get his new account confirmed. This page will need to receive some parameters but I don't want the url to be something like .../confirmation?userId=1 . I want it to be an ecrypted url to avoid abuses, is this possible? So far, I have something like this:

 public class CancelReservationPage extends WebPage{

 public CancelReservationPage(PageParameters pageParameters){
  // get parameters
  // confirm account
  // etc..
 }
}

What's next?

Thanks!

Answer 1

You don't need encryption, better making your parameter totally agnostic. Just generate a random string, for example 12 char long, that you store in DB in the user table.

Answer 2

Pretty simple:

1. before sending the email, generate a unique key (a series of characters, the easiest would be a GUID)
2. store this unique key in the database and link it to the associated user account
3. include this key as a parameter in the account confirmation URL sent in the email
4. in the account confirmation page code, check the database to see if the received code is genuinely generated by your code
5. if the key is in your database then activate the account

Answer 3

Aside from the solutions with storing unique key in the DB, there is a more convenient but perhaps less secure method (vulnerable to disclosure of the secret key and breaking of the hash).

Generate a URL containing userId and hash(userId + secretKey), where secretKey is an unique key of your application and hash is something like SHA-1. So, malicious person can't compute the hash unless he knows the secret key, and you can validate the confirmation request by comparing incoming hash with the newly computed one.

SHA-1 can be computed using java.security.MessageDigest or Apache Commons Codec's DigestUtls.shaHex().

You may also include an expiration date to make your confirmation link valid for the limited time.