通过“Magic-Link”进行 Firebase 身份验证

Question

I want to send notification mails to users of my community platform coded with react and firebase. I was wondering is there is a way to authenticate the user via a magic link which is contained in his or her personal notification mails.

Eg You've got 5 new comments on your post click HERE to read them

Clicking "here" should redirect the user to the page and automatically authenticate him without having to enter their individual passwords or usernames.

Answer 1

Due to the cancelation of the privacy shield framework and Schrems II , you might no longer be able to store customer details in the GCP.

A solution for it can be pseudonymization .

I am running an open-source project that can help you with that.

Check out the following article for more information:

https://databunker.org/use-case/schrems-ii-compliance/

Answer 2

I think your question can be divided into 2 different questions.

1. How do I send notification mails to my community platform?

I have never used notification mails in Firebase, I usually use google's SMTP server directly and send a request to the server to send an email on behalf of me. So, in your case, I would search up the library on your tech stack (for me it was Go's gomail ), then you can use Google's SMTP server (host:smtp.gmail.com, port:587).

2. How do I make a link that automatically authenticate your users whenever they click the link?

I feel like this is the harder question. I think you need to consider a few things:

• Your links need to be short lived. Why? to prevent unauthorized brute force login attempt (this also depends on the structure of your link). However, best practices suggests that links should be short lived (less than 24 hours).
• Given that links are short lived, this depends on whether the user checked their email frequently for notification from you! There's a pretty good chance that they will miss that email in the 24 hour window.

I'm pretty much against sending time sensitive notification like that through emails. But if it is something that you still want to do, it is pretty easy to create the link, the simplest way I did it was:

1. Generate a random uuid for a link.
2. Associate it to the user who will login with the link. You should save this association in a persistent data storage.
3. Create an endpoint for magic link, for example /magic/:link_id that takes link_id then checks what user should be logged in.
4. Voila! You got yourself a magic link!

Finally, you can send the link through email like the first part of the problem!