setup-auth-magic-link

You implement passwordless magic link authentication by generating a single-use token, sending it via email, and exchanging the verified token for an HttpOnly JWT cookie. This system handles email-based token generation, verification, and session cookie issuance for FastAPI and React.

Magic link authentication prevents brute-force attacks and token replay using SHA-256 hashed single-use tokens with short expiration. It applies atomic verification to stop race conditions, alongside anti-enumeration responses and email or IP rate limiting on endpoints.

Yes, you can use HttpOnly JWT cookies for session management after magic link verification. The system exchanges a successfully verified single-use token for a secure HttpOnly JWT cookie, which manages the user session across subsequent credentials-based API calls.

The best way to handle React frontend routes for passwordless login is to use a dedicated email input route and a verification route. The verification route reads the token from the URL and calls the FastAPI verify endpoint with credentials included to finalize the session.

Magic link authentication requires anti-enumeration protections for secure login to prevent attackers from guessing valid email addresses. The system applies anti-enumeration responses alongside rate-limited endpoints to protect the email-based token generation flow.

Magic link tokens need atomic single-use verification in a FastAPI backend to prevent race-condition replays. If multiple requests attempt to use the same token simultaneously, atomic operations ensure only the first succeeds while invalidating the hashed token immediately.