One-time login link in asp.net identity

Question

Some mobile apps like slack have popularized the idea of allowing your users to get a one-time use login link (Slack calls this the magic login link).

The idea is that you enter your email and instead of having to enter your password of a mobile, you request a magic login link that can be used once to log you in by opening that link on your phone.

I'm implementing this in asp.net identity 2.1, and I'm unsure how to ensure that the link that's generated can only be used once.

I generate a token like this:

var token = await _userManager.GenerateUserTokenAsync("MyLoginLink",user.Id);

This token is added to a URL for the user. The action method that the link redirects you to checks that the link is valid for that user, and then logs you in:

public async Task<ActionResult> LoginLink(string email, string token)
{

    var user = await _userManager.FindByNameAsync(email);

    // some checks ommited

    //check for an expired token:
    var result = await _userManager.VerifyUserTokenAsync(user.Id, "MyLoginLink", token);
    if (!result)
    {
        // Failed
        return RedirectToAction("Login");
    }

    await _userManager.UpdateSecurityStampAsync(user.Id);
    await SignInAsync(user, true);

Now - if I update the security stamp with user.UpdateSecurityStamp, that re-generates the security stamp, which will invalidate this token, and ensure it can't be used again. The problem with that is that it also invalidates any existing logins, so if the user is also logged in on a desktop, they'll be forced to logoff and on again.

Is there a relatively simple way to create one-time use token like this in asp.net identity, that doesn't invalidate all existing logins?

Answer 1

You can generate your own token so it's not depend on ASP.Net Identity.

You should add UserId and ExpirationTime in your token. You can set ExpirationTime to one minute so a token is not valid for a long time.

If you need to make sure that your tokens are one-time only, you should store your used tokens in memory and check them in your token validation and since you have ExpirationTime you can clear your tokens soon, so it won't take so much of your memory.

public class MagicLinkToken
{
    public int UserId { get; set; }
    public DateTime ExpirationTime { get; set; }
}

public class MagicLinkTokenDataFormat : ISecureDataFormat<MagicLinkToken>
{
    private readonly IDataProtector dataProtector;

    public MagicLinkTokenDataFormat(string name, string purpose)
    {
        dataProtector = new DpapiDataProtectionProvider(name).Create(purpose);
    }

    public string Protect(MagicLinkToken data)
    {
        var json = Newtonsoft.Json.JsonConvert.SerializeObject(data);
        var bytes = System.Text.Encoding.UTF8.GetBytes(json);
        var protectedTokenBytes = dataProtector.Protect(bytes);
        return Convert.ToBase64String(protectedTokenBytes);
    }

    public MagicLinkToken Unprotect(string protectedText)
    {
        var protectedTokenBytes = Convert.FromBase64String(protectedText);
        var bytes = dataProtector.Unprotect(protectedTokenBytes);
        var json = System.Text.Encoding.UTF8.GetString(bytes);
        return Newtonsoft.Json.JsonConvert.DeserializeObject<MagicLinkToken>(json);
    }
}

You can create and use MagicLinkTokenDataFormat as singleton.

 MagicLinkTokenDataFormat magicLinkTokenDataFormat = new MagicLinkTokenDataFormat("APP_NAME", "PURPOSE");

Generate Token

 MagicLinkToken magicLinkToken = new MagicLinkToken
 {
     UserId = userId,
     ExpirationTime = DateTime.Now.AddMinutes(1)
 };

 string token = magicLinkTokenDataFormat.Protect(magicLinkToken);

Verify Token

MagicLinkToken magicLinkToken = magicLinkTokenDataFormat.Unprotect(token);
if (magicLinkToken != null && magicLinkToken.ExpirationTime < DateTime.Now && !GeneratedTokens.Contains(token))
{
    var user = await _userManager.FindByIdAsync(magicLinkToken.UserId);
    await SignInAsync(user, true);

    // add to list to ensure of one-time usage
    GeneratedTokens.Add(token);
}