Test-Driven Development with Python, 3rd Edition

Chapter 19. User Authentication, Spiking, and De-Spiking

Our beautiful lists site has been live for a few days, and our users are starting to come back to us with feedback. “We love the site”, they say, “but we keep losing our lists. Manually remembering URLs is hard. It’d be great if it could remember what lists we’d started.”

Remember Henry Ford and faster horses. Whenever you hear a user requirement, it’s important to dig a little deeper and think—​what is the real requirement here? And how can I make it involve a cool new technology I’ve been wanting to try out?

Clearly the requirement here is that people want to have some kind of user account on the site. So, without further ado, let’s dive into authentication.

Naturally we’re not going to mess about with remembering passwords ourselves—​besides being so ’90s, secure storage of user passwords is a security nightmare we’d rather leave to someone else. We’ll use something fun called “passwordless authentication” instead.¹

Passwordless Auth with “Magic Links”

What authentication system could we use to avoid storing passwords ourselves? OAuth? OpenID? “Sign in with Facebook”? Ugh. For me, those all have unacceptable creepy overtones; why should Google or Facebook know what sites you’re logging in to and when?

Instead, for the second edition,² I found a fun approach to authentication that now goes by the name of “Magic Links”, but you might call it “just use email”.

The system was invented (or at least popularised) back ...