将JWT作为电子邮件中的激活URL有多安全？
例如：
点击链接激活您的帐户
http://127.0.0.1:8000/account/activate/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJ0b3B0YWwuY29tIiwiZXhwIjoxNDI2NDIwODAwLCJodHRwOi8vdG9wdGFsLmNvbS9qd3RfY2xhaW1zL2lzX2FkbWluIjp0cnVlLCJjb21wYW55IjoiVG9wdGFsIiwiYXdlc29tZSI6dHJ1ZX0.yRQYnWzskCZUxPwaQupWkiUzKELZ49eM7oWxAQK_ZXw
解决方法
FAQ you link to说：
Use-cases for a JWT token in a url are:
- account verification – when you email a person a link after they register on your site. 07001
- password re-set – ensures that the person re-setting the password has access to the email belonging to the account. 07002
Both of these are good candidates for single-use tokens (which expire after they have been clicked).
所以,是的.只需确保每封电子邮件只能激活一次(并且不要使用示例中可怕的“秘密”密钥,如果签名可以伪造,则可以绕过您的验证).
