Magic links
App Router
Log in without a password. The username is sealed into a URL, and opening that URL unseals it and starts a session.
How it works
- A Server Action seals the username with
sealDataand returns the link. The page renders it throughuseActionState, so nothing navigates away. - Opening the link hits a Route Handler that calls
unsealDataand saves the session. A tampered or expired seal unseals to an empty object, so it redirects back without logging anyone in. - The token is sealed with its own password, never the session one. Both shared a password once, which meant a link token was a valid session cookie and the other way around. A leaked link in an email or a referrer header was a full session.
- The token has a 15 minute
ttl. Without an invalidation list a link still works more than once inside that window, so treat it as a short-lived bearer token.