3 ms·
Not necessarily, some services would have the magic link verify the session that triggered it regardless of browser or device. I assume it generates a session
by o999 2y ago
Not necessarily, some services would have the magic link verify the session that triggered it regardless of browser or device.
I assume it generates a session on the post-login screen and authorize that session upon accessing link
- ydant 2y agoThat has the problem of opening up an attack where the attacker requests the sign-in link, the person receiving the link blindly clicks it, and the attacker now has access. People blindly click links all the time. It would have a low success rate, but would be more than 0%.