从电子邮件链接自动登录[重复]

Question

This question already has an answer here:

• How should I implement 'Token Based Authentication' to a set of web APIs in a secure way using PHP and MySQL (without using OAuth)? 2 answers

I'm trying to create a link in (PHP), when clicked user automatically login in the website passing the authentication. Example: like Facebook is sending the link to verified your account after clicking browser open the Facebook and the user is login

</div>

Answer 1

This isnt a great idea due to security concerns, but here is a solution:

When sending and email generate som random string token token, save it in your DB along with user id.
In email send link, maybe something like : mypage.com/login?token=GENERATED_TOKEN
When receiving this POST request, search through database looking for that specific token. If match is found, go ahead and log in user which this token belongs to.
How to generate such token: best practice to generate random token for forgot password

note: this aproach is viable when generating links for things like password reset links to verify user that are single use (deleted / marked after one use) and are time-limited (for example links works only 6 hours after being send).
Please do not use this for regurarly logging in users