would greatly appreciate some advice from the experts here on this stackexchange.
I'm building an application that requires access to a user's resources from a 3rd party application. This 3rd party does not provide any sort of OAuth-like authorization to allow a user to grant my app this type of permission.
However, the 3rd party has an API that allows me (as a whitelisted trusted partner with app-level API keys) access to any user's information as long as I have their account ID. They also have an API that allows me to search for a user's account ID via their email address.
Since a delegated authorization type scheme isn't available to me with this 3rd party, I'm considering the following as was hoping to get some feedback:
- Ask the user of my app to enter in the email address associated with their 3rd party account.
- Show them a form for entering in a code and tell them to check their email.
- Send that email address a secure, one-time link which when clicked gives them the code.
- Enter that code in my app.
Now (I believe) I have verified my app user is the owner of this email. I can now use the 3rd party APIs to find their account ID (via this email) and retrieve their secured resources from this 3rd party.
Any feedback would be greatly appreciated. SMTP being an insecure protocol gives me pause. I'm wondering if there are other holes I'm not thinking of.
I see this post- Is sending authorizing links through e-mail a vulnerability? - may be asking the same question. Feels like accepted answer is that it's ok but not great so long as the mechanism sent via email is short lived.