I would like to implement a password-less login for a mobile application (discussion board/social media).
- The data contains non-critical social media content (usernames, posts, replies, photos).
- The goal is to keep people's identity anonymous. A user's identity would be a hashed email address, preventing people from signing up more than once.
- The login should be easy and therefore password-less. It should happen via a "local" link (e.g.
- The app's email server would not store emails that were sent out.
- All communication to the server in the backend is encrypted via HTTPS (TLS), email traffic is not.
The login flow would be the following:
- To request a login link, mobile app
POSTs the user's email address to a server endpoint
- The server will store the hashed email and a temporary, random, short-lived token (both the email and the token expire after 5 minutes) and send a link containing the token to the email address the user sent.
- To sign in, the user opens the link with the temporary token. This will open the app and pass the token from the URL to the app.
- The app will use the token to retrieve a long-lived (1 month) JWT token from the server via an endpoint
/getJWT. The server will immediately delete the temporary token, but keep the email hash to be the user's identifier.
- The app can now use the JWT to perform any actions on behalf of the user.
- Should the JWT be close to expiration, the app will try to obtain a new token. If the user hasn't been logging in for a month, he will have to follow the process again.
I would love to hear some feedback on this approach.
One issue that I see is that it may be slightly more insecure than a "password-forgotten" functionality: There is no secret factor that only the user could know (a security question, for example). An attacker could try to initiate the login flow himself and fetch the temporary token somewhere along the way.
Would you see this as an acceptable risk?