What are best practices for activation/registration/password-reset links in emails with nonce
问题 Applications send out emails to verify user accounts or reset a password. I believe the following is the way it should be and I am asking for references and implementations. If an application has to send out a link in an email to verify the user's address, according to my view, the link and the application's processing of the link should have the following characteristics: The link contains a nonce in the request URI ( http://host/path?nonce ). On following the link (GET), the user is