Beginner LevelAuthentication & Authorization
How does Passwordless Email Magic Link authentication work?
❓ Interview Prompt: Explain single-use cryptographic tokens, email verification links, short expiration TTLs, and session generation.
Passwordless Magic Links allow users to log in without passwords by clicking a single-use secure link sent to their verified email address.
Execution Flow:
1
User enters email at '/login'.
2
Server generates a high-entropy random token (e.g. 256-bit crypto string) or a signed JWT.
3
Server stores a SHA-256 hash of the token in the database with a short expiration TTL (5 to 10 minutes) and 'used: false' flag.
4
Server emails the unhashed token link ('https://app.com/verify?token=...').
5
User clicks the link. Server hashes the incoming query token, verifies match and expiration, marks token as used, and issues a session cookie.
Code Implementation Example
typescript
import crypto from 'crypto';
async function generateMagicLink(email: string): Promise<string> {
const rawToken = crypto.randomBytes(32).toString('hex');
const tokenHash = crypto.createHash('sha256').update(rawToken).digest('hex');
const expiresAt = new Date(Date.now() + 10 * 60 * 1000); // 10 Min TTL
await db.magicTokens.create({ email, tokenHash, expiresAt, used: false });
return "https://app.company.com/auth/verify?token=" + rawToken;
}💡Generating single-use hashed passwordless magic link tokens.
🎯 Interview Key Takeaway
Magic links store token hashes in DB with short TTLs, emailing unhashed single-use links for passwordless login.
#Magic Links#Passwordless#Email Auth#Crypto#Beginner
Back to all Authentication & Authorization Questions→