passwordless-auth
Login with only your e-mail. A prototype implementation. Trade transient loginToken for persistant accessToken.
Requirements
- log in without a password
- stay logged in via persistant token on page reloads
- user reply to e-mail if login does not work
loginToken
- expires in [n] min
- public
- sits in URL
- contains user + ts
accessToken
- never expires
- private
- sits in localStorage
- contains user
Tests
$ npm test
TODOs
- check accessToken on load
- trade accessToken for secret
- trade loginToken for persistant accessToken
- send loginToken via e-mail
- re-route instead of showing errors on client
- only accept login from known users
- proper error handling - server and client
-
createAccessToken
needs a failure route -
verifyLoginToken
anddecryptAccessToken
needs try catch block - remove invalid accessToken
- add 404 route
- put checkUser between
verifyLoginToken
andcreateAccessToken
-
createAccessToken
should only create token - modularize auth with args for
loginTokenValidWindow
,encryption-key
- use proper html for anchor when sending link
- include URLparser in router
licence
MIT