why would you let the user login, before she even confirmed the e-mail address? in most system it works like that:* user registers | * email is sent to given address | * user clicks on the activation link (NO login required) | * account is activated | * from now on the user can login if that's what you want, I could show U some of our code View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4126981#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...