aaronn / django-rest-framework-passwordless

Passwordless Auth for Django REST Framework
MIT License
714 stars 152 forks source link

What about logging in again? #92

Open dubesar opened 3 years ago

dubesar commented 3 years ago

I have registered and the user logs out from client app, now how to login with same emailid and create new token? Is there a way to do so?

khashashin commented 2 years ago

When it comes to passwordless authentication, we need to understand that the process deviates from the traditional registration/login procedure. In this paradigm, your email provider acts as the source of authentication.

Here's a brief overview:

  1. When you register, you provide your email address to the client application.
  2. The application then sends an authentication token to this email address.
  3. You retrieve the token from your email and use it to log into the client application.

In this workflow, the token essentially functions as your password.

If a user logs out and needs to log back in, the same process is followed:

  1. The user enters their email address.
  2. The application sends a new authentication token to the email.
  3. The user retrieves the token and uses it to log in.

This process generates a new token each time a user needs to log in, enhancing security by not requiring a persistent password that can be compromised.

Remember, in passwordless authentication, the token is your "password". This token is ephemeral and changes with every login attempt, which is the principle behind the security of passwordless authentication.

I hope this clarifies the concept for you. Let me know if you have any further questions.

skynette commented 1 year ago

how do i view this tokens via the shell?

I'm trynna implement this with sessions since I'm using templates