4 ms·
Almost :-) The tokens are one-time only. Afterwards the session is keeping track of the user. Another login requires a different token. Regarding the emails of
by thesumofall 12y ago
Almost :-) The tokens are one-time only. Afterwards the session is keeping track of the user. Another login requires a different token.
Regarding the emails of Facebook, etc.: Great example, actually! I guess the problem really is that they don't make it obvious to users that they actually hold an authentication token in their hands.
- codezero 12y agoYeah I assumed they were one-time only. In examples I've seen, each link had a different token, so if you forwarded something, one of the links may work if you hadn't clicked that particular one. When ever I explain this to people, and forward them one of my notifs from Facebook, they get pretty paranoid and shocked, then eventually accept it because of the convenience :)