Re: Feature Request: tokens for authentication

Actually, although it is broken right now, the authenticate-via-url is 
already theoretically possible, although still with a user/pass combo.

   http://my.host.net/test.survey?action=display&username=joel&pass=test

The user would still only have to click the link, although admittedly it 
looks a bit more gothic than a simple ?token=token approach.

   // Joel


On Fri, 3 Dec 2004, Todd Slater wrote:

> Hi,
>
> I'm not sure "tokens" is exactly the word for this, but here's what
> would make Mod_survey *really* user-friendly for me :).
>
> The biggest problem I have is inviting participants to a survey. If I
> want it secure I can use username/password combos, but this introduces
> the possibility (likelihood) of user error. What would be cool would be
> if I could provide a list of email addresses and then generate tokens
> for each user. Then an email would be sent to invite each person, with a
> link to the survey that includes their token, i.e.
> http://www.survey.com/election.survey?token=1234567890. No token or
> invalid token, no survey. If that user's token has already completed the
> survey, no survey. (The possibility should still be there to allow
> anonymous and multiple submissions, of course.)
>
> I have to confess that I disovered this while visiting PHPSurveyor and
> playing around with the demo there. I still prefer Mod_survey, but this
> token stuff in PHPSurveyor is really slick.
>
> Would this be difficult to implement, or is there some other security
> consideration I'm missing? Thoughts?
>
> Best,
> Todd
> Skickat av Todd Slater <[email protected]>
> till survey-discussion
>
Skickat av Joel Palmius <[email protected]>
till survey-discussion