通过电子邮件URL安全登录

Question

I would like my users to be able to login instantly by following a URL in their email:

Such as:

Hello User, Click here to access your account: https://mysite.com/?user=12345&login=38904753290875

The user number would be fixed, but the login would NOT be a password, just a ONE TIME access token with a 24 hour expiration.

Is this secure, or do I still need to ask them for their password when logging in?

Note, when logged in, the user won't be able to change their password without giving their password.

Answer 1

Is this secure, or do I still need to ask them for their password when logging in?

The security depends on your authentication design. Good security, even a single sign-on, doesn't depend on a single action.

Things to consider:

transport of sensitive information (for example, even if the url is https, how sure are you about their email providers) - the impact of what these users could do in worst case scenario's - how to detect unauthorized actions, since the 'id' has 24 hour free play?