Tutorials I've come across about implementing magic link authentication (in Node) recommend a mechanism like this:
- the user hits your endpoint with their email address
- you generate a signed JWT from the email and the date using a constant key (if you are a bit more savvy, you use the asymmetric
RS256scheme instead of the symmetric
HS256used in most tutorials (being the default I think))
- send the email with the token as a query parameter
- user clicks, endpoint gets hit, you verify the JWT, then the email and the date inside
Apologies for the possibly very small brain question, but why do we actually need hashing or encryption here?
Would it not be more prudent to just generate a large (like 50 chars), unique, random, alphanumeric string (let's call it
LURA) then store it, the email and the date and send it to the user? When the verification endpoints get hit, we can say, "yepp, I have that thing on file and I issued it 2 minutes ago, in you go". The purpose of using JWT would be to verify that I was the one who created the token (with my key), but I can also verify that if I just see if I have the
LURAstring on file, right? Also, JWT has problems. I have a feeling JWT was intended to be used when the machine that's validating it is different then the one issuing it and that its use is detrimental to security in this case.
Bonus question: I've read multiple times regarding encrypting passwords, that
SHA256is way too weak in 2020 and that one should pick
Argon2. Why then is
RS256a good choice if it is "to be understood as SHA 256 with RSA 2048 bits keys".