3 ms·
If someone gets a hold of your email, they could easily request another login token anyway. I think it's fine if it doesn't expire.
by shanecleveland 12y ago
If someone gets a hold of your email, they could easily request another login token anyway. I think it's fine if it doesn't expire.
- ny2244111 12y agoNow I remember why I made it expire and/or only usable once. Consider public places or caching. Since the temporary authentication token is exposed in the URL there is a risk that someone else can reuse it. Whereas if it's a one time temporary token then you should be OK. I think I need to be more explicit in that this is a one time token. The whole passwordless thing is new so there are some pain points.