3

So the idea is to have a link in the email that automatically logs a customer in when clicked.

I know it is critical especially in terms of security, here's what I've got for now:

  • store the generated links in a database table
  • generate a random hash value stored against the customer id
  • both hash and customer id in the URL
  • in case the hash does not match the one stored for the customer_id, reset the hash (to avoid brute forcing)
  • make the links one use only
  • set an expiration time on the links

I'm looking for any good recommendation on this approach, and how can I improve it ? What did I miss ? What are the risks left with such approach and how to overcome them ?

closed as off-topic by Anna Völkl, Qaisar Satti, Amit Bera, davidalger, Keyul Shah Jul 13 '16 at 0:37

  • This question does not appear to be about the Magento e-Commerce platform within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 6
    Hi, I think this is a general Web Application Security question. You should better ask it here: security.stackexchange.com – Anna Völkl Jul 12 '16 at 11:00
  • Have to add: I appreciate the question itself and also what you've already thought about, but it's not a Magento specific question. :) – Anna Völkl Jul 12 '16 at 11:28
  • 3
    I've posted a similar question a million years ago: magento.stackexchange.com/q/10209/146 It was about loging in as a customer from the backend. Maybe you can use that and adapt it to your needs. As for risks, you look like you already know them. – Marius Jul 12 '16 at 11:29
  • 1
    @Marius if you're interested security.stackexchange.com/questions/129846/… – Raphael at Digital Pianism Jul 12 '16 at 12:43
  • 1
    @RaphaelatDigitalPianism now that's an awesome answer on the infosec SE :) – Anna Völkl Jul 12 '16 at 12:57
3

For those wondering here's the idea based on the answer I got here: https://security.stackexchange.com/questions/129846/implementing-an-autologin-link-in-an-email/129850#129850:

Database table

It will containg the links

  • link id
  • token hash
  • customer email
  • expiration date

Link protection

To make them secure, the link token should have at least 72 bits of entropy (9 bytes, or 12 Base64 characters) but you need to use an internal PHP random generator or read bytes directly from /dev/urandom. Have a read at this article to understand how most of the PHP random methods are not really random: http://phpsecurity.readthedocs.io/en/latest/Insufficient-Entropy-For-Random-Values.html?highlight=hash

In the database you need to store the hash of the token and not the token itself in case the database is stolen so the token can only be seen in the email.

Securing your custom controller

Every link must be secured thus you need to add the following for your custom route in your config.xml

<frontend>
    <secure_url>
        <custom>/custom/</custom>
    </secure_url>
</frontend>

Then when you generate the URL don't forget to make the URL secure:

Mage::getUrl('custom',array('_secure'=>true));

One use only

In your custom controller you'll have to retrieve the token parameter then look for a corresponding entry in the database table that matches the hash. If found, retrieve the corresponding customer email and delete the corresponding link row in the database

After that you can log in your customer the standard way.

Expiration time

Choose a relatively small expiration time: 24, 48, 72 hours.

Whenever you create a link set the expiration time as today + expiration.

Then you need a cronjob that runs every 5 minutes and that generates a collection of links where the expiration date is less or equal to today datetime.

And delete all those entries.

Not the answer you're looking for? Browse other questions tagged or ask your own question.