Magic Link Pitfalls

Magic links have several non-obvious pitfalls beyond standard security practices like expiration and one-time use. GET-based link previews and browser prefetching can prematurely claim codes, so a click confirmation page is needed. Additionally, magic links often open in email in-app browsers instead of the user's original browser, so the link should only verify the code while the original tab auto-refreshes to complete login.