Documentation
¶
Overview ¶
Package magiclink implements sign-in through an emailed one-time link.
The plugin uses only the public plugin package. It receives no privileged access to Auth-All internals, so a third-party plugin can do the same work.
Index ¶
Constants ¶
const DefaultTTL = 15 * time.Minute
DefaultTTL is the default lifetime of a sign-in link.
const ID = "magic-link"
ID is the stable plugin identifier.
const TokenKind = "magic-link"
TokenKind is the one-time token namespace of this plugin.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Option ¶
type Option func(*Plugin)
Option configures the plugin.
func WithCallbackURL ¶
WithCallbackURL sets where the browser goes after a successful sign-in. The default is the configured base URL.
func WithCreateUser ¶
WithCreateUser controls whether an unknown address creates an account. It is enabled by default, because a magic link proves ownership of the address.
func WithVerifyURL ¶
WithVerifyURL overrides the absolute link that the email carries. The default is the verify endpoint of this plugin.
func WithoutConfirmation ¶
func WithoutConfirmation() Option
WithoutConfirmation lets GET /magic-link/verify complete the sign-in on its own. The default needs the confirmation step.
Do not use this option unless you accept three risks. An attacker can make the browser of another person open a link and sign that person in to the account of the attacker. The token reaches the callback host through the Referer header. A mail scanner that pre-fetches the link consumes the token, so the person can no longer sign in.
type Plugin ¶
type Plugin struct {
// contains filtered or unexported fields
}
Plugin is the Magic Link plugin.
func (*Plugin) Send ¶ added in v0.6.0
Send sends a sign-in link to an address. It does the work of POST /magic-link/send, so a server-rendered form can send a link from its own handler and render its own confirmation.
Send applies the magic-link-request rate limit and returns apierr.ErrRateLimited when the limit refuses the request. It returns nil in every other case, including an invalid address and an unknown address when account creation is off, so the caller discloses nothing about the account.
r is the request of the host form. Send reads the client IP from it for the rate limit, and it runs the origin check on it, so a forged cross-site form fails with apierr.ErrOriginNotAllowed. A nil request skips the origin check, and the rate limit then keys on the address only.
callbackURL is where the browser goes after the sign-in. It passes the same safe-redirect check as the route, and an empty value takes the configured callback.
Source Files