I'm developing a site where users have their own 'profile' pages but which won't be public. I have a redirect in place currently which sends the visiting user away if not logged in (and not the owner). However, I'd also like the profile owner to be able to share a 'magic link' with a non-user via email. Originally I attempted to do this with
wp_nonce until I realised that the nonce would only validate in the session for which it was generated.
So... I'm wondering what's the best way to share these personal, secure links. I guess that I'm going to need to store something in the DB, perhaps a hash of the recipient's email address in the user_meta which I could check against when the user lands at website.com/member/[id]?hash=hash_of_recipeint_email. I'd like to include some method of expiry in there as well (though it will be long) so perhaps checking to see if the user_meta timestamp was not older than now minus a year.
Alternatively, I could do it with a nonce but require the visitor to enter their email when they land and, if their email has been granted access (stored in owner's user_meta), let them in with a nonce and email them the nonce url too.
I suppose I'm wondering if there's a better solution that I'm not thinking of or perhaps even if there's something that I'm missing with wp_nonce like some way to make them non-session specific.
To summarise, I'm looking for a way to grant access to a specific page, to specific users for a limited amount of time via email.
Thanks for reading.