确认电子邮件链接提交 ID 的最佳方式
我有一个网站向某人发送确认电子邮件。
现在，在电子邮件中，我希望有一个链接，用户必须单击以确认他收到了邮件。
我想将用户的密码（或一些随机代码）包含到确认地址中，这样用户就不需要再次手动输入它，但如果我这样做，密码最终将出现在浏览器历史记录中，并且日志文件。
有没有其他方法可以在电子邮件中获取确认链接以发送用户名和密码等信息，而不会以某种方式最终出现在链接中？
例如，是否可以在电子邮件中包含输入表单并以 POST 而不是 GET 方式发送密码？
I've got a web site sending someone a confirmation email.
Now in the email I would like to have a link the user has to click to confirm he received the mail.
I'd like to include the user's password (or some random code) into the confirmation address, so the user does not need to enter it by hand again, but if I do this, the password will end up in the browser history and the log files.
Is there any other way to get a confirmation link in an email to send information like a user name and password, without it ending up in the link somehow?
Is it, for example, possible to have an input form in an email and send the password as POST instead of GET?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
通常的工作方式是确认电子邮件包含一个链接，其中包含某种 GUID（全局唯一标识符）。 GUID 与用户的帐户相关联。 单击该链接时，Web 应用程序只需设置确认标志并使用 GUID（而不是通常的用户名和密码组合）让用户登录。
The way this usually works is that the confirmation email contains a link that includes a GUID (Globally Unique Identifier) of some sort. The GUID is associated with the user's account. When the link is clicked the web application simply sets the confirmation flag and logs the user in using the GUID rather than the usual username and password combination.
根据用户的 id 和当前时间计算十六进制摘要（例如 md5）。 将此代码保存到数据库中，或将其作为文件名写入一个文件，并包含用户的 ID 和电子邮件地址。
设置一个 http 处理程序（cgi、php、servlet 等）来接收基于 URI 的 GET 请求，该 URI 类似于“/confirm_email/{hexdigest}”或“/confirm_email.php?code={hexdigest}”
当用户需要确认他们的电子邮件时，发送一个指向上述包含摘要的 servlet 的链接。
当有人链接到此 URI 时，检索具有匹配摘要的数据库记录或文件。 如果找到，则包含的电子邮件地址现已得到验证。
如果你想让它更强大：当用户验证他们的电子邮件时，将十六进制摘要更改为电子邮件地址本身的哈希值，不加盐。 然后您可以测试某人的电子邮件是否已更改并需要重新验证。
Calculate a hex digest (e.g. md5) based on the user's id and the current time. Persist this code to a database or write a file with it as the filename, and include the user's ID and email address.
Set up a http handler (cgi, php, servlet, etc...) to receive GET requests based on a URI that looks something like "/confirm_email/{hexdigest}" or "/confirm_email.php?code={hexdigest}"
When a user needs to confirm their email, send a link to the above servlet containing the digest.
When someone links to this URI, retrieve the db record or file with the matching digest. If one is found the email address contained is now verified.
If you want to make it more robust: When a user verifies their email, change the hex digest to just be a hash of the email address itself with no salt. Then you can test if someone's email has changed and needs to re-verify.
您可以在电子邮件中传递 GUID。 该特定 GUID 必须与用户相关联。 然后，当用户单击链接时，GUID 会发送回应用程序，并可作为查询字符串进行捕获。 提取 GUID 作为用户已批准的更新。
You can pass the GUID in the email. That particular GUID has to be associated with the user. Then when the user clicks the link the GUID is sent back to the application and can be captured as a QueryString. Extract the GUID an update that the user has been approved.