🛠 iron-session examples

Magic links

App Router

Log in without a password. The username is sealed into a URL, and opening that URL unseals it and starts a session.

GitHub Logo Get the code for this example
How it works
  1. A Server Action seals the username with sealData and returns the link. The page renders it through useActionState, so nothing navigates away.
  2. Opening the link hits a Route Handler that calls unsealData and saves the session. A tampered or expired seal unseals to an empty object, so it redirects back without logging anyone in.
  3. The token is sealed with its own password, never the session one. Both shared a password once, which meant a link token was a valid session cookie and the other way around. A leaked link in an email or a referrer header was a full session.
  4. The token has a 15 minute ttl. Without an invalidation list a link still works more than once inside that window, so treat it as a short-lived bearer token.

← All examples