Magic Link Authentication

Magic link authentication is a passwordless approach where users enter their email address, receive a unique login URL via email, and are authenticated when they click the link. This eliminates the need for passwords entirely, shifting the authentication factor from 'something you know' to 'something you have' (access to the email account). The approach is used by services like Slack, Notion, and Medium for its simplicity and security advantages over weak passwords.

The flow works as follows: the user submits their email, the server generates a cryptographically random token, stores it with the user identifier and an expiration time, and emails a link containing the token. When the user clicks the link, the server validates the token (exists, not expired, not already used), authenticates the user, invalidates the token, and creates a session. The security of this mechanism depends on the security of the email channel and the properties of the token.

Key implementation considerations include: generating tokens with at least 256 bits of entropy, setting short expiration times (10-15 minutes), making tokens single-use (delete or mark consumed immediately on use), rate-limiting link requests per email address (prevent email bombing), binding the token to the requesting IP or device fingerprint for additional verification, and using a separate short-lived token in the URL that maps to the actual authentication token server-side (preventing token leakage in referrer headers or server logs). Always serve the callback URL over HTTPS and consider implementing a confirmation step before completing authentication to prevent email pre-fetching from consuming the token.