Auto login links in email

Mat ‎ What do you mean with this: Just to avoid such a surprise it's good to have a separate Community Admin user with the WP Subscriber role if you use the Magic Link functionality IMHO.

You mean the auto login link must be not sent to users who are admin because if that link is shared it can be used to hack the site?

I was planning to sent auto login links through FluentCRM that uses the same login fucntionality as the fluentcommunity login in the notifications.

To sent users email weekly where they can login directly to a certain space.

Sam Jansen you can have two kinds of Admins for the Fluent Community

• Super Admin is the wp-admin/user with the real WP Admin role. This user can manage regular/core WP but also can access your Fluent Community part (without any limits). So if the Super Admin user will be used on the Community and have the Magic Link/Auto login functionality enabled (this setting is related to All Community Users - there is no granular control I guess) then whoever will get the Magic Link can log to Fluent Community and wp-admin dashboard without any problem - just by clicking the Magic Link the user is being logged.
• Community Admin user is the wp-admin/user with the Subscriber role but in Fluent Community Settings > Managers the user has Community Admin role. In this case when the Magic link will be forwarded or shared with a bad actor there is no Admin access to your Core wp-admin part with elevated permission rights.

Note: when Magic Link is enabled then it doesn't matter that you have your 2FA implemented since the 2FA access token is not needed to log-in.

Just to mitigate the risk of getting into the Core wp-admin it's better to limit the possibility of using the Magic Link by the Super Admin - that is why having a separate Community Admin user is better and Super Admin user should not be used in the Fluent Community as much as possible in this case scenario (with Magic Links/Auto Log-in).

Question: You mean the auto login link must be not sent to users who are admin because if that link is shared it can be used to hack the site?

Answer: Yes it's better to avoid Magic Links for Super Admins - I don't think you can Disable the Magic Link aka Auto login only for the Community Admin since there is no granular control on this feature in the Settings AFAIR - either you enable auto login for the notifications for all community users or disable it.

In addition if you use the FluentAuth plugin and the Magic Link feature also there you can limit wp-admin roles (Administrator and/or Subscriber etc) who will use magic link but I dont think the FluentAuth part is the case here.

Magic links are really handy in some case scenarios but all users (especially Super Admins) should be careful when enabling this functionality for themselves.

Mat ‎ You are saying that the user itself can enable or disable this option? It is not a community wide setting?

When you use the option: sent notification of this post to all users of this post, the auto login link in the email will be only available to those that have enabled this option?

Am I understanding correctly?

Sam Jansen what I tried to explanation is that if you want to use Auto LogIn for Email Notifications for your Community Users then you should not use the Super Admin User for your community just to limit the possibility that your Super Admin will be able to get the email notification with the Auto LogIn link.

Users cannot enable/disable this Auto Login feature in their community profiles - it is a wide setting.

Either you enable Auto Login link in email notifications for all community users or not.

If you limit your Super Admin user (you won't use it for your community) and you will use only Community Admin User then you limit the possibilty for your WP core website to be hacked.

So if you enable Auto LogIn feature for your community all your community users will be able to login fast with the Auto LogIn link from the email (no matter what role has the user in your Community).

Note: I am not aware of any granular level of control for the Auto Login link.

It is a good practice to avoid Magic Links/Auto LogIn in general but if you use them then avoid using it for the Super Admin role.

Auto LogIn link will skip your 2FA (if applicable) so it means there will be an additional vector attack when it comes to your WP security (it doesnt mean that someone will hack you right away but in general you need to make an assessment for some case scenarios).

BTW..

Example1: Just imagine that when you will forward me your email notification with the Auto Login link by mistake and you are the Super Admin user for your community I can log in and do whatever I want there. Once I click the link from forwarded email I will access your community as Admin but also when I change the url to yourDomain.com/wp-admin I will be in your Core WP Admin Dashboard and you won't be notified etc.

Example2:

You can also imagine a situation when I tag someone in a post: "[@]PremiumUser please reply to this email notification by using email address: support[@]communityAdmin.com so you will get a free access to the Heaven" the community user might be drunk and follow this awesome command. When the user will get the email notification for that message to a mailbox and follow those instructions the user will provide access to the community/courses/store account. I am pretty sure that nobody will ever try to do it but this is what might happen.

PS. Then if it comes to FluentAuth separate plugin you can enable 2FA there but also the Magic Link for the login form - in that plugin you can specify which WP user roles can use Magic Link for the Login Form but his not linked to Auto Login links in email notifications. I just mentioned this plugin just to give an example.