I have an application that will send an SMS reminder for user containing a URL to log on. I would like to avoid user typing in username/password and log him in directly. For that I plan to use an access token and add it to the url, e.g:
Now since that is an SMS, I cannot hide it behind the "a" tag. So I would like to limit the length of the token as much as possible not to scare users too much. Perhaps also limit the symbols to only capital letters or something or some other way of "beautifying" it.
Is this is a proper approach to do it and if yes, then what security should be applied to the token. As far as I can see I need this:
- Generate the token using CSPRNG
- Make sure it's enough entropy (my application does not deal with very sensitive info, so I suppose say 32 bits should be enough, maybe even less as the username/password is just phone/digital pin code)
- Make sure that the token is one-time and/or short lived (e.g 24 hours)