{
  "id": 8119472,
  "title": "My Login Link and My Unsubscribe Link Are the Same Kind of String",
  "url": "https://urgent.news/2026/09/17/my-login-link-and-my-unsubscribe-link-are-the-same-kind-of-string",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-17T21:58:21.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/nabeelbaghoor/my-login-link-and-my-unsubscribe-link-are-the-same-kind-of-string-3eb6"
  },
  "original_language": "en",
  "account": "Upwork Scout's signup flow introduced passwordless authentication, moving all authentication work into a single file. The auth layer consists of three types of links: a login link, a session (cookie), and an unsubscribe link. All three are signed JWTs using the same secret.\n\nThe verification function ensures that only the correct type of token is accepted. A short-lived magic link (15 minutes) caters to inboxes being shared or forwarded, while a longer-lived unsubscribe link (365 days) exists to help users stop receiving emails. The user ID is derived from the email address and serves as a deterministic identifier, not a secret.",
  "summary": "Upwork Scout has no password field. It never had one. When I was sketching the signup flow I told myself I was removing work: no hashing, no reset flow, no rules about symbols and capital letters, no breach surface built out of passwords people reused from somewhere else. That held for about a week. Then I looked at what I had actually done. I had not removed the work. I had moved all of it into…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}