Our system uses passwordless login to send user a login code+link per mail by which they can login.

We found one of our customers mail scanner actually clicks those links. We invalidate the login codes on use the reduce the attack surface for an attacker. But now emails delivered do no longer have a valid login link.

There seem to be two solutions to this:

• Do not provide a login link but only a code in mail.
• Let the login code be valid after first time use for X period (say it invalidates after 15 minutes.

Option 1 seems to be unacceptable by our UX team.

Option two seems to be much less secure:

• Provides a bigger attack surface because more codes will be active in our database
• Social engineering will be easier: a user could take a picture of someones mail and type of the code within the valid period (even though user already used the code) and login with this code.

Would there be any other or better solution that would be both UX friendly and (atleast as) secure?

Our system uses passwordless login to send user a login code+link by e-mail by which they can login.

We found one of our customers has a mail scanner that actually follows those links. We invalidate the login codes on use to the reduce the attack surface for an attacker. But now such emails no longer have a valid login link.

There seem to be two solutions to this:

• Do not provide a login link but only a code in the message.
• Let the login code be valid after first time use for X period (say it invalidates after 15 minutes)

Option 1 seems to be unacceptable by our UX team.

Option two seems to be much less secure:

• Provides a bigger attack surface because more codes will be active in our database
• Social engineering will be easier: a user could take a picture of someones mail and type of the code within the valid period (even though user already used the code) and login with this code.

Would there be any other or better solution that would be both UX friendly and (atleast as) secure?