My site has a news subscription system. When an item is updated, a notification email goes out to everyone subscribed to that item.
You can un/subscribe via a form on each item's page.
I wanted to include a direct unsubscribe link in the notification emails. Then I figured people might be logged-out, or viewing the email on a different machine from their login (we don't allow users to be simultaneously logged-in on different machines), so I wanted to create a one-click unsubscribe function that does not require someone to be logged-in.
Naturally, this meant a (hopefully) unique token.
My test solution is this:
- when a user subscribes to an item, a token is generated via sha512 on a concatenated string of various things (username, datetime, itemid, etc.)
- the unsubscribe link includes the item ID, item type, and token as GET parameters
- if and only if all three things are matched on one row in the
user_subscriptionsdatabase, the row is removed thereby ending the subscription
This works, and I suspect it is adequate for this non-security sensitive task of subscribing and unsubscribing to news posts.
What leads me to Security.SE is the larger question of how secure is such a token system for other actions?
sha512 yields a 128 character hash, plus you'd have to nail the ID and Type of the action you wish to perform...