[ncallaway]

I just recently implemented a magic link flow for a project I’m working on, and “authenticated in the originating browser” was a high priority item for me.

I think it’s just so much nicer of an experience to not have to worry where you go check the email or which browser opens when you click the link there.

The site you used to login was clearly where you intended to be, so that should definitely be one of the authenticated sessions when you click the link.

[thdxr]

The issue I ran into with this was I could initiate a login for anyone and if they accidentally hit the link I could remote login.

Switched to pin code entry, less fancy but achieves all the desired UX

[ncallaway]

I think that’s totally fair. The site I’m working on is pretty low stakes from a security perspective (a private personal blog), with less technical people in the audience, so I was willing to make that trade off for the UX outcome I wanted, but that was specific to the damage of a breach in my specific use case.