11 ms·
Issues I’ve encountered building an app with magic links: 1. Include a fallback sign-in code in your magic link, in case the user needs to log in on a device w
by rickcarlino 2y ago
Issues I’ve encountered building an app with magic links:
1. Include a fallback sign-in code in your magic link, in case the user needs to log in on a device where accessing their email isn’t practical.
2. Make sure the sign-in link can handle email clients that open links automatically to generate preview screenshots.
3. Ensure the sign-in link works with email clients that use an in-app browser instead of the user’s preferred browser. For example, an iOS user might prefer Firefox mobile, but their email client may force the link to open in an in-app browser based on Safari.
- michaelmior 2y ago> Make sure the sign-in link can handle email clients that open links automatically to generate preview screenshots. Any suggestions on what needs to be handled here? My first thought is UA checking to see if it looks like a real browser.
- nine_k 2y agoE.g. require to click a button to actually sign in, don't consume the token and establish the session on mere URL access.
- rickcarlino 2y agoIn my app, I just added an “Almost there!” Page with a button that the user needs to click. I still need to add a fallback option that uses a one time code for the other reasons mentioned above.
- timfsu 2y agoUsing a time-based expiration rather than a usage-based expiration should help
- snthd 2y agoThe link is a "safe" GET request. The page loaded via the link should do an "unsafe" POST for the login, via javascript with a form button for fallback. https://www.rfc-editor.org/rfc/rfc7231#section-4.2.1 https://www.rfc-editor.org/rfc/rfc7231#section-4.2.1 >The purpose of distinguishing between safe and unsafe methods is to allow automated retrieval processes (spiders) and cache performance optimization (pre-fetching) to work without fear of causing harm. In addition, it allows a user agent to apply appropriate constraints on the automated use of unsafe methods when processing potentially untrusted content. Exactly the same for email unsubscribe links, or a one click "buy now" link.
- justinator 2y agoAutomatic link pre-fetchers know JavaScript too and will trigger your JavaScript to post. I've had to implement a system where if the link was minted x minutes ago, the JavaScript on the landing page is disabled. It's just another arms race. It shouldn't be this hard, but in email it seems everything is additionally harder to do.
- adastra22 2y agoWhy not just have a username & password. Why make everything so complicated? We just successfully got password managers deployed to most users, only to drop passwords entirely for a subpar system?
- cuu508 2y ago> We just successfully got password managers deployed to most users Source?
- adastra22 2y agoEvery desktop and mobile OS has a built-in password manager perfectly adequate for this use case, with encrypted sync and backup capabilities.
- justinator 2y agoOne example is an unsubscribe link. Legally, it would be no bueno to have it behind any sort of login. Another is just counting if a link from an email was clicked. I want friction to be as little as possible. That's done by having some sort of redirect, but you have to use a JavaScript initiated post to weed add false positives. That's already ridiculous, but because of automated link prefetchers, you still need to disable that and show a f'n button. And then I have to answer to clients that want to know why their clickthrough stats are down precipitously and I don't honestly have the wherewithall to explain the inner workers of every filter that snoops their email before they read it.
- 2y ago
- paxys 2y agoSave a browser cookie when the login is initiated. When the link is clicked check if the same cookie is present. If not, ignore it. Expire the link and the cookie after n minutes.
- michaelmior 2y agoAfter reading the other replies, this seems like one of the more effective approaches. Thanks!
- Macha 2y agoSurely this breaks the "email is not on same device as login" use case? At least with normal magic links, they're merely incredibly annoying but doable (via e.g. typing in the URL)
- deleted 2y ago[deleted]
- paxys 2y agoThat use case still works. In fact it works better because if you click the link on your phone you don't automatically get logged in on your phone browser (or your email client's in-app browser). You can then copy the same link on your desktop and it will work as expected.
- foxhop 2y ago[dead]
- layer8 2y ago1 and 3 are mentioned in the article. It’s still annoying if there is no password option.
- mooreds 2y agoWe went to a lot of trouble to make our magic link implementation work with anti-phishing software, corp link checkers and more. https://github.com/FusionAuth/fusionauth-issues/issues/629 https://github.com/FusionAuth/fusionauth-issues/issues/629 documents some of the struggle. I think that a link to a page where you enter a one time code gets around a lot of these issues.
- andrei_says_ 2y agoI arrived at the same conclusion after going through the steps and seeing that some corporate systems mark the login link as malicious, and there’s nothing I can do about it. Sending a code goes around a lot of issues.
- js2 2y agoAlso: Safari can autofill codes from both email and text messages on macOS and iOS. It then automatically deletes the message too. https://www.webnots.com/how-to-autofill-verification-codes-in-safari-from-email-and-messages/ https://www.webnots.com/how-to-autofill-verification-codes-i...
- deleted 2y ago[deleted]
- adastra22 2y agoWhy not just support a password?
- ThePowerOfFuet 2y agoBecause ≈everyone reuses passwords and so accounts get taken over.
- sam_lowry_ 2y agoSo what?
- paxys 2y ago3 isn't really possible, because the redirect needs to take you back to the browser session where you initiated the login from.
- o999 2y agoNot necessarily, some services would have the magic link verify the session that triggered it regardless of browser or device. I assume it generates a session on the post-login screen and authorize that session upon accessing link
- ydant 2y agoThat has the problem of opening up an attack where the attacker requests the sign-in link, the person receiving the link blindly clicks it, and the attacker now has access. People blindly click links all the time. It would have a low success rate, but would be more than 0%.
- pests 2y agoI might receive a magic link on my phone but then sometimes I'll copy/paste that over to my desktop or another device. This works on 99% of magic links I've tried except for cases when they are trying to prevent account sharing. I remember the Bird bike app did this, where they required the magic link to be clicked on the same device login was initiated on. I was using my friends account and he would just forward me the link until one day this stopped working.
- yieldcrv 2y agoOne thing I recently found annoying with Slack was that I wanted the company chat on my phone, but I didnt want the company’s email on my phone given the overly broad control of my phone so I got the magic link on their computer and then I made a qr code but wait, the email quarantine system had altered the whole link so I had to extract that but wait the redirect url back to slack was malformed because of the url encoding and i had to fix that and then make the qr code like wow just give me a qr code or code instead in the original magic link email!
- tzs 2y agoWould it have worked to forward the mail from your work email system to your personal email?
- sthatipamala 2y agoIf it’s a big corp, they probably have strict data exfiltration policies for corp email. Maybe this one email would have been fine, but if it gets tripped, it’s not worth the headache.
- k3lsi3r 2y agoThese same corps have opinions on where users can be logged into Slack as well. And ffiw most enterprises that have this kind of device management don't allow login via magic links via email anyways.
- yieldcrv 2y agoYes, accurate, I was able to access some slack workspaces but not the main one without putting the invasive management profile on my phone
- yieldcrv 2y agoIt wouldnt have worked any differently from the first qr code with quarantine, and been a flagged violation, eventually
- tzs 2y ago4. Make sure the sign-in link on mobile works with your mobile app. When McDonald's switched from email/password to magic links I had a hard time getting the magic link to work with the McD app. It usually would just open in the McD website. Thus was quite annoying because about 98% of the time I eat McD's I would not do so if I could not order via the app [1]. I finally gave up and switched to using "Sign in With Apple" (SIWA). There was no way that I could find to add SIWN to an existing McD account, so had to use the SIWA that hides the real email from McD. That created a new McD account so I lost the reward points that were on the old account, but at least I could again use the McD app. [1] They have a weekly "Free Medium Fries on Friday" deal in the app available for use on orders of at least $1. Almost every Friday for lunch I make a sandwich at home and then get cookies and the free fries to go with it from McD.
- SOLAR_FIELDS 2y agoI have heard that you are basically paying double what you normally would if you aren’t hunting for deals in mcd’s app these days. How much truth is there to that?
- red_phone 2y agoThe difference isn’t nearly that dramatic, but there are definitely savings to be had via the app.
- packtreefly 2y agoA lot. MCD corporate seems determined to get on the user data gravy train, and appears to be subsidizing it for the franchisees. Three large fries ordered at the counter costs over ten dollars.
- crazygringo 2y agoSure they want user data to observe people's purchasing habits. But they already have that if you always use the same debit or credit cards like most people do. But the more people use the app, the less cashiers they need and the less ordering kiosks they have to install. Plus customer satisfaction goes up because you can order ahead and your food is ready when you arrive. And getting used to the discounts means you probably won't switch to Burger King or Wendy's. I think additional user data is a relatively minor part of it.
- ctm92 2y agoThese days there's also to consider that some Mail Threat Protection Tools (at least Microsoft Defender in Exchange Online does this) click links in Mails to check them. Recently ran into this issue as new mail accounts got confirmed automatically and magic links were invalid when the user clicked them, because Microsoft already logged in with it during checking.
- aspect0545 2y agoWhat can you do to prevent automatic confirmation in that case?
- sandermvanvliet 2y agoAs far as I know there’s nothing. The alternative is to send an OTP in the mail and tell the user to enter that. In that way there is no link to auto confirm. However, if you do that ensure that you have a way to jump straight to the page to enter the OTP because (looking at you Samsung) the account registration process can expire or the app is closed (not active long enough) and your user is stuck
- miohtama 2y agoThe link leads to a page where you need to press a button (HTTP POST).
- mixedbit 2y agoI run an authorization service that allows to log-in using magic links and we managed to solve this. First approach was for the link opening GET request to do not log the user in, but to include an HTML page with JavaScript that issued a POST request with a code from the link to log the user in. This worked well for a long time, because email scanners were fetching links from emails with GET requests but did not execute JavaScript on the fetched pages. Unfortunately, some time ago Microsoft tools indeed started to render the fetched pages and execute JavaScript on them which broke the links. What works now is to check if the link is open in the same browser that requested the link (you can use a cookie to do it) and only automatically login the user in these cases. If a link is open in a different browser, show an additional button ('Login as <email address>') that the user needs to click to finish the login action. MS tools render the login page but do not click buttons on it. The issue that MS tools introduced is broader, because it affects also email confirmation flows during signups. This is less visible, because usually the scanners will confirm emails that the user would like to confirm anyway. But without additional protection steps, the users can be signed up for services that they didn't request and MS tools will automatically confirm such signups.
- ThrowawayTestr 2y agoIs 3 even possible?
- miki123211 2y agoOne of the biggest advantages of magic links is that they're unphishable while still being easy to use (unlike passkeys). Having a code completely negates that advantage, as attackers can just set up a fake website that asks for the code. Magic links should log you in on the device you click them, not on the device that requested the login session. Anything else, while being a little bit less annoying, is a security issue and should be treated as such.
- hombre_fatal 2y agoWhen using magic links, you can still support the common UX polish of letting a user log in on a different browser/device. If the user opens the magic link in the same browser that initiated the email, then just log them in. Otherwise, present them with the Apple-style "Do you want to authorize a login from 1.2.3.4 using Firefox on iOS possibly located in Portland, Maine? [Authorize] or [Reject]".
- tarxvf 2y agoThat would require I have my email on every device I might want to log in with. I don't like that for a number of reasons.
- hombre_fatal 2y agoThe conventional password system requires you to have a shared password manager on every device or that your reuse or memorize passwords. And that none of the service's users reuse passwords. It's all trade offs, else it would be easy.
- tarxvf 2y agoI can access my password manager on my trusted device, and manually type in my password for whatever service on any other device. This is exactly what I do for the rare but important time when I need to login on a device I don't want to have total access to everything.
- 2y ago
- KronisLV 2y ago> For example, an iOS user might prefer Firefox mobile, but their email client may force the link to open in an in-app browser based on Safari. Hey, wasn’t Firefox on iOS based on Safari related tech anyways? https://en.m.wikipedia.org/wiki/Firefox https://en.m.wikipedia.org/wiki/Firefox > However, as with all other iOS web browsers, the iOS version uses the WebKit layout engine instead of Gecko due to platform requirements. I do agree with what you’re saying though! Just those two in particular will probably have pretty good compatibility, which I was amused to find out when I looked into it.