spring-projects / spring-projects/spring-security
Consider allowing `oneTimeTokenLogin()` to authenticate different devices
Open
Nobody has claimed this yet.
in: web
type: enhancement
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
One common requirement is to request a One-Time Token from your computer browser, open the magic link on your phone (where you are authenticated), and then the browser, instead of the phone, is logged in.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the oneTimeTokenLogin() entry point and tracing how the one-time token is requested, opened, and converted into an authenticated session. Confirm the behavior across a computer browser and an authenticated phone; done means the browser is logged in after the magic link is opened on the phone without weakening the one-time-token security guarantees.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100