Hacker News new | past | comments | ask | show | jobs | submit login

A good way I can think of is to include a user's secret (hashed password or whatever), HMACed with the number of the week. This way, the token expires at the end of the week. There would be a problem with links sent late Sunday, but I guess you could always try verifying with the previous week's number as well.

Of course, I'm not sure if this is faster than storing random tokens in the database and expiring them, but it sounds like it should be.




So, uh, why the downvotes with no comment?




Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: