MealPro

[karh]

Thanks Ken, this is awesome! But I didn't expect anything less from you (as you've always been very helpful).

This describes the process for security providers that are not using the Use Password Hash Verify option but rather are hashing manually.

I just checked and we have it ticked

Why would this not work with this enabled? (Not 100% sure what it does)

[mebeingken]

Sorry, I haven't had to deal with that since that option came in well after I set this up, but because the hashing is done internally, I suspect it will make the process of what to hand off to the security provider different. There are probably some hashing actions that can be used.

[bpj]

I don't think it will make too much difference to the process that @mebeingken gave. You will just need to store the token using Argon hash rather than hashing with a salt

[tbvgl]

I do it like this:

1. Create a token

(UUID+TIMESTAMP).md5(TIMESTAMP).substr(0, 42).encodeBase64Url()

3. Hash the token with Argon2id
4. Store the hash in Redis:
   Key: 'magic-login-'+queryUser.id Value: hashed token

3. Send a link with the token and user_id in the query via email
4. Check if the key exists in Redis:

5. Verify the token with the hash:

6. Log the user in:
   I have a separate db field in the user table with an auth secret that is used for logins instead of the password. The password is only used to verify password logins.