Password-free login

[larsivi]

Feature request

To simplify login, especially on mobile clients, a password free login using urls-with-token received via email (or SMS, or other notification mechanism). We have discussed this briefly in slack, so I think we are more or less on the same page.

Is your feature request related to a problem? Please describe.

Password based login, especially with complicated generated passwords, on mobile phones can be a real kludge (it is surprisingly difficult to mark/copy/paste password from email on a smart phone), and especially for inexperienced users.

Describe the solution you'd like

A trigger will cause the server to send a message to the user. This message includes an url to the site, including a token, and when clicking on it, the user will be logged in. The url may be customized to point to a particular place on the site where you'd like to come when logged in. This may be due to a server-generated invitation for example, where you also want to log in the user.

In addition, there should be graphql and rest endpoints to ask for such a token, giving e.g. the relevant email or user id.

Additional context

This issue is meant to be used for additional discussions, etc. I have made a fork at https://github.com/larsivi/accounts, and will start the work now. For time restrained reasons I expect to use some of these features in a real-world pilot prior to making a PR.

[larsivi]

As discussed on slack, this is meant to be implemented as a new strategy.

[pradel]

Closing as already implemented :)