[keycloak-dev] Reset password and verify email links are to long

[Stian Thorgersen]

Are you talking about reducing the size of the code altogether or just for the email links?

I was thinking about just saving the base64 encoded access-code with the user session temporarily, then sending the the access code id (36 char uuid as before) in the email. First time the user clicks on the link the access code would be removed from the session, so this would also make the links a one-time-click thing. 

----- Original Message -----
> From: "Bill Burke" <bburke at redhat.com>
> To: "Stian Thorgersen" <stian at redhat.com>
> Cc: keycloak-dev at lists.jboss.org
> Sent: Tuesday, 15 July, 2014 6:14:45 PM
> Subject: Re: [keycloak-dev] Reset password and verify email links are to long
> 
> 
> 
> On 7/15/2014 12:34 PM, Stian Thorgersen wrote:
> >> If that's what you're saying +1.
> >
> > Are you referring to option 1, storing the required info in the user
> > session temporarily? Not sure I understand the details about what you're
> > proposing though.
> >
> 
> Yes, option 1.  AccessCode should be associated with the user session.
> Appropriate state needs to be stored in the session as AccessCode
> currently saves a lot of stuff.
> 
> Then the code only has to contain:
> 
> id, session-id, timestamp
> 
> 
> 
> --
> Bill Burke
> JBoss, a division of Red Hat
> http://bill.burkecentral.com
>