Passwordless Laravel Auth Is Easy to Demo and Harder to Run Well

Short summary

Passwordless auth in Laravel is easy to prototype but hard to run in production because email scanners, preview clients, and security gateways prefetch GET links and consume single-use tokens before the user clicks. The solution is a two-step flow: a signed GET renders a confirmation page, then a CSRF-protected POST consumes the login attempt. Signed URLs alone don't make a flow production-ready—you need explicit state, single-use consumption, step-up hooks, and support visibility.

• •Magic-link consume-on-GET breaks in production due to email scanner prefetching
• •Use a GET-to-confirm plus POST-to-consume pattern with CSRF protection
• •Signed URLs protect integrity but don't solve single-use, replay, or device-trust problems

Generated with AI, which can make mistakes.