Magic links are a great way to get people into their membership accounts quickly and easily, but they can be a risk if the link ends up in the wrong hands.

Now magic links are time-limited.

Key Enhancements

• 15 min time limit for magic link expiration
• 90 days limit for database deletion
• Rate limit for user generated magic link is 5-6
• User can request magic link for themselves till 90 days since they last logged in
• Secret token is encrypted so login information is secured
• It is backward compatible so old magic link will work as it is till user request new ones

Why it Matters:

The overall goal is to avoid security incidents related to the misuse of permanent magic links.

• Minimizing the window of time that an unauthorized user can use a link to gain access.
• Reduces the likelihood of link theft and replay attacks.
• Increases user trust by demonstrating a commitment to protecting their data.
• Enhances compliance with modern security standards and best practices.