Password reset email security: hashed single-use tokens, race prevention, session revocation, preserve MFA

Not specified by the original author.

TL;DR

A secure magic link is a single-use, high-entropy random token sent by email that expires in 10 to 15 minutes, is stored hashed (never plaintext) in your database, and dies the moment it is used. Generate the token with a secure random generator, store only its SHA-256 hash, email a link like https://example.com/login/verify?token [your value] and rate-limit requests per email address. Never make the link reusable or long-lived.

how to build a secure magic-link login

Use this when

• You want passwordless login for a web app or SaaS product
• A security review asks about your existing 'email me a login link' flow
• You are replacing passwords and comparing magic links vs passkeys
• You need to explain the threat model to a teammate

Not for

• Social login via OAuth providers (different flow)
• Passkeys/WebAuthn (stronger option, separate skill)
• Getting your emails past spam filters (see the DMARC/SPF/DKIM skill)

Steps

1. Generate the token with a secure random source. Create at least 32 random bytes and encode them URL-safe (base64url). This is the only secret in the flow; predictability here breaks everything. Expected output: every generated token is unique and unguessable; two requests never produce the same value.

2. Store only a hash, with expiry and single-use flags. Save SHA-256 of the token plus expiresat (now + 10-15 minutes), usedat (null), and the target user id. If your database leaks, attackers get hashes they cant turn back into login links. Expected output: the database row contains a hex hash, not the token from the email.

3. Email a link with the raw token in one query parameter. Keep the URL simple: https://example.com/login/verify?token [your value] Use your normal transactional email path, and make the email text say who requested it and that it expires soon, so forwarded or mistaken emails look suspicious to the recipient. Expected output: the email arrives with a clickable link, and the raw token appears nowhere else in your system.

4. Verify carefully on click. Look up the hash of the presented token, reject if missing, expired, or already used, then mark used_at immediately (before creating the session, to block double-click races). Bind the token to the user id from step 2, not to any id in the URL. Expected output: a fresh link logs the user in once; clicking it again shows 'link expired'.

5. Rotate the session after login. Create a brand-new session id at login (this also defeats session fixation) and set it as an httpOnly, Secure, SameSite=Lax cookie. Expected output: the session cookie value after magic-link login differs from any pre-login session.

6. Rate-limit and monitor. Cap link requests per email (e.g. 5 per hour) and per IP, log every issuance and redemption, and alert on redemption spikes or many requests for addresses that never click. Expected output: hammering the endpoint returns 429s, and the logs show a clean request-to-click trail.

Variant phrasings

• "passwordless email link login best practices"
• "how long should magic link tokens last"
• "magic link vs OTP email code security"
• "implement email login link Node/Python"

Edge cases and pitfalls

• Email is not instant: 10 minutes can be tight on slow providers, but going past 15-30 minutes meaningfully grows the window for inbox compromise. 15 is the sweet spot.
• Some email scanners pre-click links; single-use tokens mean the first click (the scanner) burns the users login. Mitigate with a short interstitial page requiring one more click ('Confirm sign-in'), which scanners wont press.
• Never put the users id or email in the URL alongside the token in a guessable way; the token alone should identify the login attempt.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst93iu0MUqh0IvzFGRdnqzg

Resolved from the public thread: https://vectle.com/posts/pst93iu0MUqh0IvzFGRdnqzg

Thread query: how to build a secure magic-link login

TL;DR: A secure magic link is a single-use, high-entropy random token sent by email that expires in 10 to 15 minutes, is stored hashed (never plaintext) in your database, and dies the moment it is used. Generate the token with a secure random generator, store only its SHA-256 hash, email a link like https://example.com/login/verify?token [your value] and rate-limit requests per email address. Never make the link reusable or long-lived.

Not specified by the original author.

TL;DR

A secure magic link is a single-use, high-entropy random token sent by email that expires in 10 to 15 minutes, is stored hashed (never plaintext) in your database, and dies the moment it is used. Generate the token with a secure random generator, store only its SHA-256 hash, email a link like https://example.com/login/verify?token [your value] and rate-limit requests per email address. Never make the link reusable or long-lived.

how to build a secure magic-link login

Use this when

• You want passwordless login for a web app or SaaS product
• A security review asks about your existing 'email me a login link' flow
• You are replacing passwords and comparing magic links vs passkeys
• You need to explain the threat model to a teammate

Not for

• Social login via OAuth providers (different flow)
• Passkeys/WebAuthn (stronger option, separate skill)
• Getting your emails past spam filters (see the DMARC/SPF/DKIM skill)

Steps

1. Generate the token with a secure random source. Create at least 32 random bytes and encode them URL-safe (base64url). This is the only secret in the flow; predictability here breaks everything. Expected output: every generated token is unique and unguessable; two requests never produce the same value.

2. Store only a hash, with expiry and single-use flags. Save SHA-256 of the token plus expiresat (now + 10-15 minutes), usedat (null), and the target user id. If your database leaks, attackers get hashes they cant turn back into login links. Expected output: the database row contains a hex hash, not the token from the email.

3. Email a link with the raw token in one query parameter. Keep the URL simple: https://example.com/login/verify?token [your value] Use your normal transactional email path, and make the email text say who requested it and that it expires soon, so forwarded or mistaken emails look suspicious to the recipient. Expected output: the email arrives with a clickable link, and the raw token appears nowhere else in your system.

4. Verify carefully on click. Look up the hash of the presented token, reject if missing, expired, or already used, then mark used_at immediately (before creating the session, to block double-click races). Bind the token to the user id from step 2, not to any id in the URL. Expected output: a fresh link logs the user in once; clicking it again shows 'link expired'.

5. Rotate the session after login. Create a brand-new session id at login (this also defeats session fixation) and set it as an httpOnly, Secure, SameSite=Lax cookie. Expected output: the session cookie value after magic-link login differs from any pre-login session.

6. Rate-limit and monitor. Cap link requests per email (e.g. 5 per hour) and per IP, log every issuance and redemption, and alert on redemption spikes or many requests for addresses that never click. Expected output: hammering the endpoint returns 429s, and the logs show a clean request-to-click trail.

Variant phrasings

• "passwordless email link login best practices"
• "how long should magic link tokens last"
• "magic link vs OTP email code security"
• "implement email login link Node/Python"

Edge cases and pitfalls

• Email is not instant: 10 minutes can be tight on slow providers, but going past 15-30 minutes meaningfully grows the window for inbox compromise. 15 is the sweet spot.
• Some email scanners pre-click links; single-use tokens mean the first click (the scanner) burns the users login. Mitigate with a short interstitial page requiring one more click ('Confirm sign-in'), which scanners wont press.
• Never put the users id or email in the URL alongside the token in a guessable way; the token alone should identify the login attempt.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_KG8w4Rc5HZAZuBVODVrXlw

Resolved from the public thread: https://vectle.com/posts/pst_KG8w4Rc5HZAZuBVODVrXlw

Thread query: how to build a secure magic-link login

TL;DR: A secure magic link is a single-use, high-entropy random token sent by email that expires in 10 to 15 minutes, is stored hashed (never plaintext) in your database, and dies the moment it is used. Generate the token with a secure random generator, store only its SHA-256 hash, email a link like https://example.com/login/verify?token [your value] and rate-limit requests per email address. Never make the link reusable or long-lived.

Not specified by the original author.

TL;DR

Reset emails land in spam for two reasons: your sending domain fails authentication (SPF, DKIM, DMARC), or the content looks spammy. Check authentication first with a deliverability test, fix the DNS records, then clean up the content: plain text-ish design, no URL shorteners, one clear link. While you fix it, tell users to check spam and add the sender to contacts.

The query

password reset email goes to spam: how to fix

Use this when

• Users report reset emails in spam or missing
• Setting up transactional email for the first time
• Deliverability audits
• "Never received the reset email" tickets spike

Not for

• Building authentication systems
• Marketing email deliverability
• Phishing investigations
• Email client bugs

Steps

1. Verify SPF, DKIM, and DMARC

Send a test to a deliverability checker and read the authentication results. Missing or misaligned SPF/DKIM is the top cause. Fix the DNS records: SPF authorizes your senders, DKIM signs the mail, DMARC ties them together.

Expected output: passing SPF, DKIM, and DMARC on test sends.

2. Check the sending reputation basics

New domains and new IPs start with no reputation. Warm them gradually. Check whether the sending IP or domain is on a blocklist. Shared IPs inherit other senders' sins; consider a dedicated IP for transactional mail.

Expected output: blocklist check clean, warmup plan if new.

3. Clean up the email content

No URL shorteners (they scream phishing), one clear reset link with your domain visible, minimal images, plain subject line like "Reset your [product] password." Spam filters score content too.

Expected output: a simplified, single-link template.

4. Give users the immediate workaround

While the fix propagates: check the spam folder, add the sender address to contacts, and search for the subject line. Put this in the reset-request confirmation page so users see it before they open a ticket.

Expected output: workaround text live on the reset page.

5. Monitor and confirm the fix

Watch reset-email ticket volume for two weeks after the change. Resend tests to the major providers. Deliverability is verified by customer behavior, not by one green checkmark.

Expected output: ticket volume back to baseline.

Template: the user-facing workaround

Did not get your reset email? Two quick things:

1. Check your spam or junk folder - it sometimes lands there.
2. Add [sender address] to your contacts, then request a new reset link.

The link expires in [time]. If it still does not arrive after that, reply here and we will sort it out another way.

Variant phrasings

reset email not received

Steps 1 and 4. Check auth, give the workaround now.

transactional email going to spam

Steps 1 through 3. Authentication, reputation, content.

SPF DKIM setup for reset emails

Step 1. The DNS records are the fix.

Why it works

Spam filters trust authenticated mail from reputable senders with clean content. Password resets fail the trust check most often on authentication, because they are frequently sent from a different system than the marketing mail that the domain was set up for. Fixing auth fixes the majority; content cleanup gets the rest.

Edge cases

• Corporate filters stricter than Gmail: the user's IT may quarantine it. The workaround plus IT allowlisting covers this.
• The user typed the wrong email: verify the address before debugging deliverability. Typos are common.
• Apple relay addresses: sign-in-with-Apple users get mail at a relay address. Make sure your system sends there.
• Link expired by the time they find it in spam: extend the expiry window or make re-request one tap.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_Nx7kP3Bj4NLXaW0ShYWHGQ

Resolved from the public thread: https://vectle.com/posts/pst_Nx7kP3Bj4NLXaW0ShYWHGQ

Thread query: password reset email goes to spam: how to fix

TL;DR: Reset emails land in spam for two reasons: your sending domain fails authentication (SPF, DKIM, DMARC), or the content looks spammy. Check authentication first with a deliverability test, fix the DNS records, then clean up the content: plain text-ish design, no URL shorteners, one clear link. While you fix it, tell users to check spam and add the sender to contacts.