2

I want to give a newsletter subscriber the possibility to change his information. Since we're using an external company for sending our newsletter I can't put a key right into the newsletter (or not without much effort).

I created a form where you can enter your email and after checking if it's a subscriber, it sends an email with a link to change your information.

The link contains the plain e-mail and a hashed key which is made like sha1(email + "someString") so for example:

domain.com/change.php?mail=your@mail.com&key=356a192b7913b04c54574d18c28d46e6395428ab

In my script, I then check if the given email + "someString" results the same as the key.

I know the link would stay the same to change your information, but I wanted to ask if there is any security issue in doing this whole thing this way, or should I rather create unique keys and store them in the database?

It would only be to change your prename, last name - maybe I bother too much.

  • Is "someString" a static value that is used for all users/requests or does it differ with each request? – ilikebeets Feb 3 '15 at 11:15
  • Would have been static, but will now use unique ones and store them in database – Som1 Feb 3 '15 at 13:21
2

Since you want to change the user information, you presumably already have a db with (email, first name, last name) so I would add the token there too (plus an expiration time).

If you would use it in a stateless way (eg. just to confirm subscription), that's an acceptable approach, but you should be using a HMAC rather than a hash of concatenated values.

  • The DB with the user information of the newsletter is in the external company as well.I know my first attempt wasnt optimal and lazy i was curious if it would be enough. But im now creating and storing unique id in our db with expiration, just to be sure. – Som1 Feb 3 '15 at 16:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.