[FIXED] Is it secure to log in a user without a password?

Issue

I am thinking of logging a user in to my Django website by verifying the email rather than them having to write a password.

If this is not clear, this is what I'm thinking:

1. User enters email
2. User gets a email containing a code
3. User enters code in website
4. User is logged in

Is this safe to do without hackers accessing the accounts of other users?

Solution

As far as I understand your problem you want to generate tokens for users that would serve as an authentication method to access your service.

I don't know how secure that is because you have to take into consideration a lot of different things like length of the token (password) and method you use to generate it. Also some kind of a token rotation should be incluced.

Instead of this you can use more popular approach to this problem that is either

• delegating authorization to 3rd party software like Google auth (https://www.tutorialspoint.com/google-authentication-in-django)
• adding OAuth authorization - currently OAuth 2.0 is the newest version (https://en.wikipedia.org/wiki/OAuth)

With that users can log into your website without typing password every time they want to access it.

Answered By - mlokos