2

I want to give a newsletter subscriber the possibility to change his information. Since we're using an external company for sending our newsletter I can't put a key right into the newsletter (or not without much effort).

I created a form where you can enter your email and after checking if it's a subscriber, it sends an email with a link to change your information.

The link contains the plain e-mail and a hashed key which is made like sha1(email + "someString") so for example:

domain.com/change.php?mai[email protected]&key=356a192b7913b04c54574d18c28d46e6395428ab

In my script, I then check if the given email + "someString" results the same as the key.

I know the link would stay the same to change your information, but I wanted to ask if there is any security issue in doing this whole thing this way, or should I rather create unique keys and store them in the database?

It would only be to change your prename, last name - maybe I bother too much.

Improve this question
3
  • Is "someString" a static value that is used for all users/requests or does it differ with each request?
    – ilikebeets
    Feb 3, 2015 at 11:15
  • Would have been static, but will now use unique ones and store them in database
    – Som1
    Feb 3, 2015 at 13:21
  • 5 years old, but if anyone is looking at this recently, consider that people may forward your emails.
    – bones225
    Sep 29, 2020 at 19:15

1 Answer 1

Reset to default
2

Since you want to change the user information, you presumably already have a db with (email, first name, last name) so I would add the token there too (plus an expiration time).

If you would use it in a stateless way (eg. just to confirm subscription), that's an acceptable approach, but you should be using a HMAC rather than a hash of concatenated values.

Improve this answer
1
  • The DB with the user information of the newsletter is in the external company as well.I know my first attempt wasnt optimal and lazy i was curious if it would be enough. But im now creating and storing unique id in our db with expiration, just to be sure.
    – Som1
    Feb 3, 2015 at 16:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .