Passwordless / magic link

[elmarw]

Would be great to have passwordless option for the Identity widget.

New user -> confirm email -> login with JWT

Existing user -> click link in email -> token in email link requests JWT

But I am not sure if this is possible at the moment with the GoTrue API? It seems to require a password for every account?

[lionzan]

I'd love this! So I could switch completely from AWS Cognito to Netlify!!!

[cameronelliott]

I am super interested in this also, and I think this might be doable without changes to this repo.

If you look at this: https://gotruejs-playground.netlify.app/#recoverypw It seems like this method should work for login.

For for signup, one could just stuff in a random bogus password for this example: https://gotruejs-playground.netlify.app/#sign-up (if the user defeats this, and inserts a blank or simple password, it's only to their own detriment, and they still must confirm sign-up)

You would stop using this method altogether: https://gotruejs-playground.netlify.app/#log-in

Confirmation would work the same as before: https://gotruejs-playground.netlify.app/#confirm

This is how login is now performed!! Wild: https://gotruejs-playground.netlify.app/#request-pw-recovery

The other methods continue to work the same.

What we really need is a specific demo but with language explaining how everything works for passwordless, similar to: https://gotruejs-playground.netlify.app

The widget would clearly not work: https://github.com/netlify/netlify-identity-widget

But this could be implemented using the Js lib: But based upon: https://github.com/netlify/gotrue-js

It would be great to get some feedback from the maintainers or someone who is interested in creating a demo.

I am proceeding to try to get this working, but my use case is a little different than most, I don't use gotrue-js, rather, I use a middleware go proxy to front gotrue.

I will follow up with my experiences.

[elmarw]

I am super interested in this also, and I think this might be doable without changes to this repo.

If you look at this: https://gotruejs-playground.netlify.app/#recoverypw It seems like this method should work for login.

For for signup, one could just stuff in a random bogus password for this example: https://gotruejs-playground.netlify.app/#sign-up (if the user defeats this, and inserts a blank or simple password, it's only to their own detriment, and they still must confirm sign-up)

You would stop using this method altogether: https://gotruejs-playground.netlify.app/#log-in

Confirmation would work the same as before: https://gotruejs-playground.netlify.app/#confirm

This is how login is now performed!! Wild: https://gotruejs-playground.netlify.app/#request-pw-recovery

The other methods continue to work the same.

What we really need is a specific demo but with language explaining how everything works for passwordless, similar to: https://gotruejs-playground.netlify.app

The widget would clearly not work: https://github.com/netlify/netlify-identity-widget

But this could be implemented using the Js lib: But based upon: https://github.com/netlify/gotrue-js

It would be great to get some feedback from the maintainers or someone who is interested in creating a demo.

I am proceeding to try to get this working, but my use case is a little different than most, I don't use gotrue-js, rather, I use a middleware go proxy to front gotrue.

I will follow up with my experiences.

I am putting something together with this method using the GoTrue API.

I'm not sure how safe it is to generate a random password client side for the initial signup. Maybe handle this in a Netlify Function. What's your input on this?

[cameronelliott]

@elmarw - I agree with your comments, and I have been looking for a different approach.

After some research, I thought /invite might do the trick, and it would, but it requires the admin token, so, this would not work for users to invite themselves. :disappointed: (You could use this method with a simple proxy, but it seems overly complicated to me)

1. Disable login

Use DISABLE_SIGNUP to disable password based sign up.

2. Instead of using /signup or signup() for new users, now use /invite

/invite docs gotrue

This link shows that the admin token is need to call /invite /invite example gotrue-js

It seems like you might be able to use netlify functions to change the password behind the scenes, but I am using a proxy in my design, so I actually can assign a true random password for /signup.

This make take some more work to use without assigning a random password.

[elmarw]

@cameronelliott

My idea was to import the gotrue-js client in a Netlify Lambda function. Post the user email on signup to that lambda -> generate strong random password there and do the signup. Everything else can be done using the gotrue-client om the browser.

[cameronelliott]

@elmarw That could verywell work, I'm not sure though. Let us know what you discover!

[parkan]

@elmarw did you have any luck with this approach? I am building an app that requires magic links and I'm currently torn between using an off the shelf but less integrated solution like auth0/magic.link + passport middleware slotted in with next-connect OR trying to recreate the functionality with netlify's identity much like you're describing

[elmarw]

@parkan It works if you wrap it in a function, but it's not very elegant. You have to use GoTrue api and restyle the password forget mail. The widget isnt of much use in this case.

[parkan]

ok, I think it may be too hacky for this project, +1 for making this a feature

[jon-sully]

I think this may be more of a feature request for GoTrue itself - leveraging the invite and password reset handlers, even with custom email markup, may well work, but I fear it might hinder the use of other auth methods in tandem. It would be a valuable addition to GoTrue itself to support email-only accounts.