Documentation
¶
Overview ¶
Package magiclink implements sign-in through an emailed one-time link.
The plugin uses only the public plugin package. It receives no privileged access to Auth-All internals, so a third-party plugin can do the same work.
Index ¶
Constants ¶
const DefaultTTL = 15 * time.Minute
DefaultTTL is the default lifetime of a sign-in link.
const ID = "magic-link"
ID is the stable plugin identifier.
const TokenKind = "magic-link"
TokenKind is the one-time token namespace of this plugin.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Option ¶
type Option func(*Plugin)
Option configures the plugin.
func WithCallbackURL ¶
WithCallbackURL sets where the browser goes after a successful sign-in. The default is the configured base URL.
func WithCreateUser ¶
WithCreateUser controls whether an unknown address creates an account. It is enabled by default, because a magic link proves ownership of the address.
func WithVerifyURL ¶
WithVerifyURL overrides the absolute link that the email carries. The default is the verify endpoint of this plugin.
func WithoutConfirmation ¶
func WithoutConfirmation() Option
WithoutConfirmation lets GET /magic-link/verify complete the sign-in on its own. The default needs the confirmation step.
Do not use this option unless you accept three risks. An attacker can make the browser of another person open a link and sign that person in to the account of the attacker. The token reaches the callback host through the Referer header. A mail scanner that pre-fetches the link consumes the token, so the person can no longer sign in.
Source Files