Ask A Question

Notifications

You’re not receiving notifications from this thread.

Magic Link Authentication with generates_token_for in Rails 7.1 Discussion

is magic link login considered secure ?
can it be used for a production website reliably ?
Thanks

Reply

As long as the tokens expire, are one-time use, and the user's email isn't compromised it should be fine. You'll still want to support 2FA through another mechanism for more security.

I much prefer email/password login so I can use a password manager.

Reply

Hi Chris,
How do you use CurrentAttributes in real world projects? as I read from several blogs that it's considered as harmful, so it's not recommended to use it.
So I want to know from your perspective regarding this.
Thanks

Reply

How are CurrentAttributes implemented in practical projects? According to several blog posts, it is deemed hazardous and therefore its use is not advised.
I would therefore like to hear your perspective on this.

Reply

How can you mock this in an integration test where you need to be authenticated but you don't have access to session?

Reply

Please note that Microsoft Outlook (and possibly other email clients) will pre-fetch the link and execute a get request and INVALIDATE THE TOKEN prior to the recipient having a chance to click on the link!

I spent some time troubleshooting this issue and I think it is worth mentioning in the video or the video notes. My solution was to add an additional step where the user needs to click on a button and confirm the login action with a POST request.

Another solution is to have the token allow multiple logins but this is much less secure.

https://stackoverflow.com/questions/34346732/do-any-common-email-clients-pre-fetch-links-rather-than-images

Reply
Join the discussion
Create an account Log in

Want to stay up-to-date with Ruby on Rails?

Join 86,796+ developers who get early access to new tutorials, screencasts, articles, and more.

    We care about the protection of your data. Read our Privacy Policy.