3 ms·

Thanks for the additional thought process here; just a minor question, what's an HMAC token?

• derekprior 10y ago
  https://en.wikipedia.org/wiki/HMAC-based_One-time_Password_Algorithm https://en.wikipedia.org/wiki/HMAC-based_One-time_Password_A... I might not be using the right term here, but the general idea is that you create an encrypted token out of some data and verify that the data is unchanged and still valid on the server. In that way you can provide a token that ensures the user had access to the link you sent them, but you don't have to store it in the database.