We're working on a conversion to Sitecore, and in their current system the client sends out emails with links back to the site. These links contain the user's email and an authentication token, so when they're clicked the user is logged in and taken straight to the page in question. We found, however, that if the email is forwarded then anyone who gets it could also log in. This might just be par for the course in this kind of scenario, so I'd like some advice on two fronts:
- Is this a standard/best practice for an email newsletter to provide such a login method? Or is it better to provide a link to the page, and if the user is logged in they get access, otherwise they need to log in (with a "remember me" option provided)?
- In Sitecore 9.1.1 or 9.2, using identity server, is using an auth token to log an end user in a doable thing, and are there any good references to this? This is in case either it is an accepted practice, or if the client insists they want it this way, I'd like to know a way to accomplish it.