I envision a login/signup-system, where the user enters his/her email, and receives an email with a link to sign in. The user clicks the link, and is automatically signed in (confirming the email address in the process).
This would be a form of passwordless authentication.
The problem I see with this approach, is that a link will send a GET request - but this GET request will change the state of the user session (activating it).
GET requests should (according to the HTTP-standard) never have side-effects. This is something browsers assume as well, which means they might prefetch GET requests to optimize performance/user experience.
Let's say you are using Gmail in the browser. Could it then happen that the browser will prefetch the link in the email?
It would be a huge security problem if simply opening the email was enough to be signed in to the site.
What I have considered
Am I right by assuming this?
Is it bad practice to do it this way?
Using a HTML form in the email body
Another option would be to place a form in the email, which would allow for a POST request from the email directly.
It seems, however - that several email clients will block form submissions from within emails. Email clients that that allow form submissions tend to warn the user that the email is likely malicious. It seems this is not really a good solution.