I'm working on a web application where a user gains access by clicking on a magic link sent to them by an internal co-worker. Upon clicking this link, the user is automatically authenticated and a session cookie is established to maintain their authenticated state.

Here's the flow I'm considering:

1.An internal co-worker generates a magic link. 2.The magic link is sent to the user’s email. 3.The user clicks on the link, the server checks if the token in the link is valid and is automatically authenticated.

Originally, I planned on using JWT (JSON Web Tokens) as the token in the URL for the magic link since JWTs are secured with a signature. However, I'm aware that JWTs are primarily intended transmitting data between parties in a way that ensures it hasn't been tampered with.

Given that, I'm starting to reconsider whether JWTs are the best choice for this scenario and instead I want to use a SecureRandom string in the URL as this token. I can just store this random string in a database and when the magic link is clicked, check if this random string in the URL is stored in the database and if it is, authenticate the user. Also, without the use of JWTs I won't have to manage a secret and can avoid ensuring it's safe storage on the server.

1 Answer 1


You certainly don't need JWTs for this, and in many ways they're a bad choice because there are lots of different ways that they can go wrong if you're not careful, and you also have to think about how you would implement some features you might want like invalidating them.

The main advantage of JWTs is that you don't need a database to store them, which can have benefits in some cases. But if you're happy with storing a load of random links in a database, then securely generated random tokens are probably better for you.

Depending on how long your magic links are going to be valid for, you may also want to hash them in the database rather than storing them in clear text. There's some discussion about hashing password reset links in another question that might be worth a read.

  • seems like this link should be one-time use. Since revoking JWTs with claims can be a little more painful of a process, (and would force a DB lookup for all future claims anyway), TOTP (time based one-time password) linked to their e-mail address in the DB seems like a better approach. Don't expect link-clicking authorization to be particularly secure, though. Nov 30, 2023 at 18:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .