2 ms·
You know that the opened token is linked to the initial client session. You can unblock that session and the user can proceed in the non-isolated browser. You h
by GoblinSlayer 5y ago
You know that the opened token is linked to the initial client session. You can unblock that session and the user can proceed in the non-isolated browser. You have this workflow with codes anyway: the user must open an email then go back to the browser and type in the code. With the link you will save on the typing.
- deleted 5y ago[deleted]
- mojuba 5y agoInteresting! (I searched, even asked on SO, couldn't find any solution for this). So to elaborate: I first store a nonce in cookies as a login session token. Once the code is validated somehow, I unblock it on the backend, and on a first chance also set my main JWT cookie if not yet set. Excellent, that solves it! P.S. Unless there are some security implications - need to think about it a bit more. Thanks!