How to build a Secure Passwordless Magic Link Login in Django - from scratch

How to build a Secure Passwordless Magic Link Login in Django - from scratch Introduction Why passwords are getting obsolete? Passwords present a significant challenges for both developers and users, making the traditional password based authentication less optimal in today's digital landscape. From users perspective: From the Developers Perspective: Why magic links are better? Magic links offer a passwordless authentication method, sending users a unique, time-limited URL via email (or SMS) that grants access when clicked. What you are going to build today? We're going to develop a Django application with session-based authentication and an email-only login. The environment variables will hold the email address for this application. By looking through the list of emails, we will determine whether the user is authorized to log in to the app. If the user's email address is present in the environment variable, we will send the magic link to their email and confirm that. Pre-requisites 💻 Project Setup Before we dive into magic link authentication, we need to get a working Django environment up and running. This includes setting up the project, installing dependencies, configuring the environment, and laying out the project structure. This part ensures you have a clean foundation before adding authentication logic. Create a new Django project and app Start by creating a virtual environment for your project. This keeps dependencies isolated and easy to manage. Install Django and the python-dotenv package, which we’ll use to securely manage credentials: Create your Django project and your core app. For this example, we’ll use the names silverback for the project and dashboard for the app: Project Directory Structure Add the new app to your project by editing my_project/settings.py: Also, confirm that SessionMiddleware is included (it is by default): Create and Configure .env for Allowed Emails Instead of using a database of users, we’ll keep a simple list of allowed email addresses in a .env file. This is especially useful for internal tools and admin dashboards. Create a .env file at the project root: Be sure to add .env to your .gitignore file to prevent it from being committed: Load .env in the settings.py Update my_project/settings.py to load the credentials list from the environment Now you can access settings.CREDENTIALS anywhere in your app and check if an email is allowed to log in. Setup the Templates Directory Then update settings.py to include the path: You’ll place login.html, home.html, and other frontend pages here later. Run intial migrations and test your server Django uses sessions to keep track of logged-in users, so you’ll need the django_session table. Run your migrations: 🔐 The Login flow Login Form Traditional login forms often ask users for both their email and a password. In this implementation, we’re removing passwords altogether — users log in using a secure magic link sent to their email. This significantly improves user experience and sidesteps common security issues associated with password storage and handling. We begin by creating a simple Django form that accepts only an email address. This form replaces the usual username/password fields, streamlining the login process for users. In the corresponding view, we validate that the email exists in our list of allowed users, which we store securely in a .env file. If the email is found, we generate a signed login token using Django’s signing framework and construct a one-time-use login link. This link is emailed to the user, who can then click it to log in. This flow removes the need for accounts or passwords, making it ideal for internal tools, dashboards, or low-risk apps. How Django signs and verifies the Magic Link A crucial part of this system is the ability to verify that the magic login link hasn't been tampered with and that it hasn't expired. For this, we rely on Django’s TimestampSigner . When the user submits their email, we sign it with a timestamp using signer.sign(email). The result is a token that looks like this: This string contains the email address, a base62-encoded timestamp, and a cryptographic signature. The signature is generated using your Django project’s SECRET_KEY , which ensures that the token cannot be forged or tampered with by anyone who doesn’t have access to your key. Later, when the user clicks the magic link and lands on the /verify/ route, the application attempts to validate the token using signer.unsign(token, max_age=300). This process checks whether the token has been altered and whether it has expired — in this case, five minutes after it was generated. If either of those checks fails, the login attempt is rejected. If it passes, the system trusts the email embedded in the token and logs the user in by writing it into the session. /verify/ This approach is secure, time-limited, and stateless - you don’t need to track token generation or expiration in a database. Sending the Magic Link via Email Once the token is created, we send it to the user via email. Django makes this easy with the send_mail function. For development, you can use the console backend to print emails to the terminal. In production, you’ll want to configure an SMTP backend, such as Gmail or SendGrid. The link in the email leads to the /verify/ endpoint with the token embedded in the query string. When the user clicks it, the token is validated, and they are authenticated. During development, the console backend is sufficient for testing. Django simply prints the email content to your terminal, which lets you simulate clicking the magic link without setting up a real mail server. For console backend (development), in the settings.py add this variable to send emails to console. For production using Gmail, in settings.py: Then in .env ⚠️ Important: If you're using Gmail, you must enable App Passwords or use a service like SendGrid, AWS SES or Mailgun for production. After every thing our views.py file looks like this: 👤 How session based Login works in Django Instead of using Django’s built-in authentication model or user system, we rely on sessions to keep the user logged in. After the token is verified, we write the user’s email into the session using request.session['authenticated_user'] = email. Behind the scenes, Django creates a unique sessionid cookie for the user’s browser and stores the session data server-side — typically in a database table named django_session. That data might look like this: The only thing stored in the user's browser is the session ID, which is signed and tamper-proof. The actual data — like the email — never leaves the server. This is what makes Django sessions secure by default. To log the user out, we simply call request.session.flush(), which clears all session data and invalidates the session cookie. 🛂 Protecting views using a custom Middleware Now that users can log in, we need to protect the application’s views so that only authenticated users can access them. We achieve this by creating a custom middleware. The middleware checks if the user has a valid session (i.e., the authenticated_user key exists). If not, and the path isn’t one of the login-related routes (like /login/ or /verify/), the middleware redirects them to the login page. You add this middleware to the MIDDLEWARE setting in your settings.py file, after SessionMiddleware. Once in place, any attempt to access protected views will redirect unauthenticated users to the login page. 🔐 Security Best Practices This system is secure by design — but only if implemented with care. For starters, make sure to use short expiration times for tokens. Five to fifteen minutes is usually sufficient. You should also configure your session and cookie settings to reduce the risk of session hijacking. Additionally, never commit your .env file to version control. This file contains a list of valid user emails and is considered sensitive data. Always add it to your .gitignore. 📚 Additional Django Docs If you’d like to go deeper into the internals, Django’s documentation is a fantastic resource. Here are some key areas to explore: Conclusion Magic link login is a powerful alternative to traditional authentication methods. It simplifies the user experience, improves security by eliminating passwords, and reduces the need for complex user management. With Django’s built-in tools like TimestampSigner, sessions, middleware, and email handling, you can build a fully functioning magic-link-only login system without relying on third-party services or a user model. This setup is ideal for admin dashboards, internal tools, MVPs, and apps where you control access via a known list of emails. It's fast, secure, and easy to maintain — and now, you fully understand how every part works.

How to build a Secure Passwordless Magic Link Login in Django - from scratch

Topics included

Social.
Snapshot.

Explore similar content

How to build a Secure Passwordless Magic Link Login in Django - from scratch

Topics included

Social.Snapshot.

Explore similar content

Social.
Snapshot.