I want a simple link to activate a customer out of an email that gets sent to the admin on registration.

I am using this module: https://github.com/enrico69/magento2-customer-activation for the registration / activation workflow.

My idea is to add a link to that email, and add a nonce / secure hash to that email which I can decrypt in a custom controller to get the customer-id. My custom controller will simply call the methods from the named module and I am set.

The question is: how do I get such a secure hash? WordPress has the wp_create_nonce() method for this. Is there a similar thing in Magento 2?


There is an non-elegant solution involving concatenating the customer id and a random salt hashed, storing the hashed salt in the database with the customer id and removing the salt when it gets used. Within the controller you would examine the database entry for the customer id, retrieving the salt and verify the hash from the email. Assuming the controller also accepts the customer id as well as the hash.

An alternative is to emulate the wp_create_nonce function: https://security.stackexchange.com/questions/186295/how-is-the-wordpress-nonce-generated

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.