Authentication using Tokens w/o Database and --no-html

[LostKobrakai]

@shotleybuilder

User issues a get request containing their email as a parameter (no post requests since there is no front end).

This should really be a post. If you’re worried about no csrf – a get request is as unsafe, but without communicating that side effects might happen.

@shotleybuilder

Now, when they come back at a later time their cookie is proof they’ve gone through the email authentication process.

True, but it also means you have no way to invalidate this authentication. It stays valid until it expired by whatever static means of expiration you’re using.