Magic Link

The plugin offers an easy way to add one-click login capabilities (through a link sent to user email)

Installation Requirement

There are no package requirements for using this feature. Users.Email.required setting must be set to true

By default the feature is enabled. The default configuration is:

'OneTimeLogin' => [
    'enabled' => true,
    'tokenLifeTime' => 600,
    'DeliveryHandlers' => [
        'Email' => [
            'className' => \CakeDC\Users\Model\Behavior\OneTimeDelivery\EmailDelivery::class
        ],
    ],
],

• tokenLifeTime: 600 seconds (10 minutes) by default. You can set how many seconds you want your token to be valid.
• DeliveryHandlers: Email delivery is included but it can be easily extended implementing \CakeDC\Users\Model\Behavior\OneTimeDelivery\DeliveryInterface (i.e. SMS Delivery, Push Delivery, etc.)

Enabling

The feature is enabled by default but you can disable it application-wide and enable via Middleware (or any other way) for specific situations using:

Configure::write('OneTimeLogin.enabled', true);

Disabling

You can disable it by adding this in your config/users.php file:

 'OneTimeLogin.enabled' => false,

How does it work

When the user accesses the login page, there is a new button Send me a login link. On click, the user will be redirected to a page to enter his email address. Once it is submitted, the user will receive an email with the link to automatically login.

Two-factor authentication

The two-factor authentication is skipped by default for this feature since the user must actively click on a link sent to his email address.

If you want to enable it by adding this in your config/users.php file:

'Auth.Authenticators.OneTimeToken.skipTwoFactorVerify' => false,

ReCaptcha

ReCaptcha will be added automatically to the request login link form if Users.reCaptcha.login is enabled. We strongly recommend having ReCaptcha enabled, because it's a public form that could be targeted by an attacker to send multiple requests.