title: Auto-login best practices
body: <p>I'm developing a web app that sends the user an email notification to complete a lesson/tutorial. I've added the ability to automatically login the user via the link in that email. This featured has been added to several services around the internet, most notable, OkCupid.</p>
  
  <p>Here's how I've set up my table:</p>
  
  <pre><code>+----+-------------+-------------------+-----------+--------------+----------------------+
  | id | key (22)    |  secret (40)      |  user_id  |  action      |  expires             |
  +----+-------------+-------------------+-----------+--------------+----------------------+
  |  1 | IbQlQW8Dn...|  hdC4dXQJUPA0...  |  1        |  lesson/14   |  2013-06-21 16:28:55 |
  +----+-------------+-------------------+-----------+--------------+----------------------+
  </code></pre>
  
  <p>When a user visits a link via the email, something like:
  <a href="http://example.com/go/IbQlQW8Dn8PNXJFFwHQxwh/hdC4dXQJUPA0pU7I6eUiXawbnobYv0iThA" rel="noreferrer">http://example.com/go/IbQlQW8Dn8PNXJFFwHQxwh/hdC4dXQJUPA0pU7I6eUiXawbnobYv0iThA</a>
  [http:/example.com/go/<code>key</code>/<code>secret</code>]</p>
  
  <p>The server first checks that the url isn't expired based on the date in the table. If it isn't expired, the user is automatically logged in using the <code>user_id</code> and then redirected to the given url in the <code>action</code> column. I used two separate values (<code>key</code> &amp; <code>secret</code>) for the url just for added security (prevent fusking).</p>
  
  <p>Now because of the nature of the site (video lessons), security isn't a huge concern, but I'd still like to know what best practices to consider. </p>
  
  <ul>
  <li>Should I limit the number of times a link can be used?</li>
  <li>Currently I have the link expire 60 hours (3 days) from when the
  email is sent. Should this be lowered?</li>
  <li>Obvious two risks for unauthorized access include someone forwarding the email or someone gaining access to the user's email account. Anything else to consider?</li>
  </ul>
  
  <p><em>Thanks for everyones insight, if this should be moved to another section of StackExchange, please let me know. I know I've seen other best practice post on here in the past.</em></p>