I'm developing a site where users have their own 'profile' pages but which won't be public. I have a redirect in place currently which sends the visiting user away if not logged in (and not the owner). However, I'd also like the profile owner to be able to share a 'magic link' with a non-user via email. Originally I attempted to do this with wp_nonce until I realised that the nonce would only validate in the session for which it was generated.

So... I'm wondering what's the best way to share these personal, secure links. I guess that I'm going to need to store something in the DB, perhaps a hash of the recipient's email address in the user_meta which I could check against when the user lands at website.com/member/[id]?hash=hash_of_recipeint_email. I'd like to include some method of expiry in there as well (though it will be long) so perhaps checking to see if the user_meta timestamp was not older than now minus a year.

Alternatively, I could do it with a nonce but require the visitor to enter their email when they land and, if their email has been granted access (stored in owner's user_meta), let them in with a nonce and email them the nonce url too.

I suppose I'm wondering if there's a better solution that I'm not thinking of or perhaps even if there's something that I'm missing with wp_nonce like some way to make them non-session specific.

To summarise, I'm looking for a way to grant access to a specific page, to specific users for a limited amount of time via email.

Thanks for reading.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.