Magento 1: implementing an autologin link in an email [closed]

Question

So the idea is to have a link in the email that automatically logs a customer in when clicked.

I know it is critical especially in terms of security, here's what I've got for now:

• store the generated links in a database table
• generate a random hash value stored against the customer id
• both hash and customer id in the URL
• in case the hash does not match the one stored for the customer_id, reset the hash (to avoid brute forcing)
• make the links one use only
• set an expiration time on the links

I'm looking for any good recommendation on this approach, and how can I improve it ? What did I miss ? What are the risks left with such approach and how to overcome them ?

Answer 1

For those wondering here's the idea based on the answer I got here: https://security.stackexchange.com/questions/129846/implementing-an-autologin-link-in-an-email/129850#129850:

Database table

It will containg the links

• link id
• token hash
• customer email
• expiration date

Link protection

To make them secure, the link token should have at least 72 bits of entropy (9 bytes, or 12 Base64 characters) but you need to use an internal PHP random generator or read bytes directly from /dev/urandom. Have a read at this article to understand how most of the PHP random methods are not really random: http://phpsecurity.readthedocs.io/en/latest/Insufficient-Entropy-For-Random-Values.html?highlight=hash

In the database you need to store the hash of the token and not the token itself in case the database is stolen so the token can only be seen in the email.

Securing your custom controller

Every link must be secured thus you need to add the following for your custom route in your config.xml

<frontend>
    <secure_url>
        <custom>/custom/</custom>
    </secure_url>
</frontend>

Then when you generate the URL don't forget to make the URL secure:

Mage::getUrl('custom',array('_secure'=>true));

One use only

In your custom controller you'll have to retrieve the token parameter then look for a corresponding entry in the database table that matches the hash. If found, retrieve the corresponding customer email and delete the corresponding link row in the database

After that you can log in your customer the standard way.

Expiration time

Choose a relatively small expiration time: 24, 48, 72 hours.

Whenever you create a link set the expiration time as today + expiration.

Then you need a cronjob that runs every 5 minutes and that generates a collection of links where the expiration date is less or equal to today datetime.

And delete all those entries.