One time use tokens about django-sesame HOT 9 CLOSED

This would require keeping a record of generated tokens on the server. However django-sesame is currently stateless. So it's a different design.

Your version will be simpler than django-sesame because you don't need any crypto, you just need to store (user_id, random_token) pairs and delete them when they're used.

django-sesame is just a few dozen lines of code on top of Django's utilities. There will be little overlap with a library implementing the behavior you're describing.

That's why I think it makes more sense to implement one-time tokens in a separate library.

from django-sesame.

Not sure if I should just start a new issue since it has been quite a while, but this is something I am interested in again. This blog post describes a way to achieve this:
https://simpleisbetterthancomplex.com/tutorial/2016/08/24/how-to-create-one-time-link.html

Basically, just add the user's last login to the hash, so that the hash becomes valid after they login again. This retains the simplicity of your design, with the option for one time use tokens. Would you be open something like this?

from django-sesame.

I don't have a strong opinion. How would user opt-in to that behavior? With a setting? With a different API for generating tokens?

from django-sesame.

I was thinking a setting, although you could also have an option on get_parameters and get_query_string to override it.

from django-sesame.

Thinking about it more, mixing the two will complicate the decoding logic.... might be easiest for it to just be a setting so you always know whether to expect the login date to be there or not. If you would accept this, I would be willing to write a PR for it... however, I do need UUID primary keys for users, so would wait until that is merged in.

from django-sesame.

I'm OK with a global setting to opt-in to single use tokens.

from django-sesame.

I have created a pull request for this - please review it and let me know if it needs any fixes to be merged in. Thanks!

from django-sesame.

Yes I've had it on my radar this week. Very busy week, unfortunately.

from django-sesame.

from django-sesame.