search

cds-snc / url-shortener

An API written in Python that shortens URLs
MIT License
4 stars 0 forks source link

Login: prevent magic link sessions from being claimed by automated link visits #383

Open patheard opened 1 year ago

patheard commented 1 year ago

Summary

Currently Outlook security scanning is claiming sessions by checking if the magic link email links are valid.

We could prevent this by adding an intermediate screen in the login flow, similar to how the https://encrypted-message.cdssandbox.xyz/ tool works:

  graph LR;
      A[Provide Email]-->B[Magic Link Email];
      B-->C[Confirm login];
      C-->D[Logged in];