A login token system

Question

Hello,

I am currently creating a very basic piece of DBMS software - I would however like the user not to have to type in their details every time. Instead I would like them to click on a control pannel link that would log them straight in.

My solution thus far has been a token system whereby there is a table in the database with the login details for that user accompanied by a tokenString - the user simply goes to a page passing the tokenString as a post variable and it logs them in.

Is this a good idea?

Many Thanks, J Harley

Answer 1

It's not completely secure, but you are making an ease of use tradeoff. So if the page you display the links on changes the tokens for each person's login every time it is loaded (and makes the tokens expire after some short time period), you'd prevent the link from getting out into the wild or someone hacking their email and getting an old login link.