4 ms·

Save a browser cookie when the login is initiated. When the link is clicked check if the same cookie is present. If not, ignore it. Expire the link and the cook

• michaelmior 2y ago
  After reading the other replies, this seems like one of the more effective approaches. Thanks!
• Macha 2y ago
  Surely this breaks the "email is not on same device as login" use case? At least with normal magic links, they're merely incredibly annoying but doable (via e.g. typing in the URL)
  • deleted 2y ago
    [deleted]
  • paxys 2y ago
    That use case still works. In fact it works better because if you click the link on your phone you don't automatically get logged in on your phone browser (or your email client's in-app browser). You can then copy the same link on your desktop and it will work as expected.
    • apitman 2y ago
      I'm confused. How do you get the cookie from the original device to the other device?
      • paxys 2y ago
        It's the other way around. You copy the URL to the device that has the cookie.
        • apitman 2y ago
          How do you copy the link between devices? QR code?
  • shakna 2y ago
    As long as you also have a code to enter, then things will feel fine across devices.