Login on all devices with magic link

[emschwartz]

If a user tries to login with one browser / device and opens the magic link from their email on another browser / device, would it be possible to securely log them in on both?

[silentworks]

Yes, this would work if the user logs into both browsers with different magic links (remember the magic links are one-time use only, so clicking on it twice wouldn't log the user in again).

[emschwartz]

Sorry I was actually wondering whether it would be possible to automatically log the user into both browsers when they click a single magic link. I believe some websites do that, though I'm forgetting which ones I've seen it on.

[silentworks]

@emschwartz that will not work with the current magic link setup. Magic links are one-time use, so once the user has logged into one browser with it, they won't be able to use the same magic link to log into another browser.

[emschwartz]

Understood. In that case, I'd like to suggest this as an idea for the future.

For some users, it's not obvious that the magic link needs to be opened in the same browser or on the same device as they want to use the service on. (This blog post describes someone else's experience with users getting confused about which browser they're opening the link in)

The nicest experience to handle this case would be that you click login on browser A, open the magic link on browser B, both tabs on browsers A and B are automatically logged in (without the user clicking on the magic link twice). I understand that it's not supported today and might be out of scope, but I'd like to propose it as a potential improvement (assuming there's a safe way to do it).

[silentworks]

There are security concerns around this and what you are suggesting is outside the concerns of a one-time password/magic link. It's probably better to update the email template that gets sent out to let the user know that clicking the link will open it in their default browser but if they wish for this to not happen they should rather copy the link (which you can do in all email clients) and paste in the browser then want to view it in.

If browser A and B are automatically logged in, it would mean both browsers are sharing the same localStorage(which is not currently possible as far as I know), this would only work if it was a session-based storage system (which is what most server-side applications would use).