Create Magic Links for users to access a .Net MVC WebApp

Question

I want to add a new feature to my WebApp for events - build with .Net MVC - to send a magic link to each participant - after they register in the event - to access the WebApp and be able to participate in a Gamification challenge.

I am using Microsoft Owin for the backoffice access, and I would like to use it to create the magic link, but I cant find any solution for that.

I have searched a token login solution but no success.

Answer 1

Is it ASP.NET or ASP.NET Core application? It shouldn't matter if you're using OWIN or not. In a ASP.NET project I have used MachineKey's Protect and Unprotect methods. Set a static machine key using machineKey element in the web.config, because it keeps being regenerated by default. If it's a load-balancing environment, set identical machine key on each node.

For example, let's say you have some key identifying the participant, most likely the email address. Include ?user=key&token=token in the link. To generate the token

var unprotected = Encoding.UTF8.GetBytes(key);
var protected = MachineKey.Protect(unprotected);
var token = HttpServerUtility.UrlTokenEncode(protected);

To validate the token, when the user accesses the application:

bool Validate(string token, string expectedKey)
{
    var protected = HttpServerUtility.UrlTokenDecode(token);
    try
    {
        var unprotected = MachineKey.Unprotect(protected);
        var key = Encoding.UTF8.GetString(unprotected);
        return key == expectedKey;
    }
    catch (CryptographicException)
    {
        return false;
    }
 }

The MachineKey's successor in ASP.NET Core is Data Protection.