We're working on a conversion to Sitecore, and in their current system the client sends out emails with links back to the site. These links contain the user's email and an authentication token, so when they're clicked the user is logged in and taken straight to the page in question. We found, however, that if the email is forwarded then anyone who gets it could also log in. This might just be par for the course in this kind of scenario, so I'd like some advice on two fronts:

  1. Is this a standard/best practice for an email newsletter to provide such a login method? Or is it better to provide a link to the page, and if the user is logged in they get access, otherwise they need to log in (with a "remember me" option provided)?
  2. In Sitecore 9.1.1 or 9.2, using identity server, is using an auth token to log an end user in a doable thing, and are there any good references to this? This is in case either it is an accepted practice, or if the client insists they want it this way, I'd like to know a way to accomplish it.

1 Answer 1


I got the same situation and i chose the option 1.

you can create a guid kind of key before sending the mail and append it with that link (www.mysite.com/user?guidid={...}).

Keep that guid stored somewhere with user details.

Once the user clicks on the link then do what you mentioned in the option one. once you get user specific information then match the keys added to the query param of the mail link and associated with the user.

if both match you can do the rest of the activity and mark that guid as expired but if it does not match you can mark it expired immediately.

this way this link can be used only once and even if someone forward it, it wont work as it already been expired or used.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.