I need your professional opinion on this matter, please.
The app I'm building has 2 parts: Teachers & students.
Teachers use the app to build a project and attach students to it.
Then, the students access the project in our system and complete some tasks.
We don't want the users to register or use an existing account (via oAuth2). We simply want them to have a quick and simple way of getting in the system, with as little setup as possible.
Should be noted that we need to allow multiple entries from different locations.
Each student will have multiple "access points", one for each project he's attached to.
The reason we care so little about the possible thefts that can occur is that the students have very limited possibilities, and the data that is shown to them isn't confidential.
I can think of 2 suitable options:
- Send the student an email with a link that contains an access key, for example:
The link will not expire.
- Send the student an email with a link and a short access key which will be required by the link, for example:
The 2nd option is more secure because the 1st will get saved in browser history, sent in the http referrer and generally exposed. Using the 2nd option insures that whoever accesses the link has/had access to the Email account. However, it is a slightly longer process for the student.
So my questions are:
- Is the added security the 2nd option delivers worth the longer process, in your opinion? I know this is a subjective question, but your opinion means a lot to me.
- If you think the 1st option's better, how long should the access key be?
I want to embed the student ID and the project ID inside it, so I was thinking about using JWTs, but they are 220 characters. Is it too much? (URLs can contain up to 2000).
- If you think the 2nd option's better, how long should the access key be?
How should I design the link? Same as in the first option? (using a JWT)
- Is there a better way?
Thanks for helping!
Note: I'm planning on using SSL, just FYI.