title: Creating a secure temporary access token for user login, is this good enough?
body: <p>Ok so I am creating an API for manipulating users and data in a web application using XML. If they POST XML they can create users, etc. I am using a 2-legged OAuth solution to secure and verify the API requests. However this question is not about that aspect of security, but the aspect I will describe is for allowing the user to login from an API request without having to type their username and password, here is what I have:</p>
  
  <p>Step 1, partner uses XML API to create a user, if successful the system returns a path containing the new ID, "/user/99" for example.</p>
  
  <p>Step 2, partner makes a request to user/login/99, this will create a new "Login Token" in my database, here are the relevant properties:</p>
  
  <pre><code>UserID      int     FK
  AccountID   int     FK
  Token       string
  Expiration  date
  Used        bit
  </code></pre>
  
  <p>UserID and AccountID are related to the respective Users and Accounts table...</p>
  
  <p>the Token is the first 20 characters of a randomly generated GUID with the dashes removed and all characters set ToUpper().</p>
  
  <p>The Expiration is 30 seconds from DateTime.Now.</p>
  
  <pre><code>Used = false
  </code></pre>
  
  <p>Step 3, the partner will have knowledge of the URL of the system (which is on a different domain from the API), and they can now make a POST to it like this:</p>
  
  <p>http://otherdomain.webapp.com/core/login/[insert guid here]</p>
  
  <p>Now, the 'otherdomain' part is going to be unique per account, so at this point we verify:</p>
  
  <p>Look up the LoginToken based on the provided guid, if it goes with the account that matches the subdomain, is NOT expired (within 30 seconds), AND 'Used' is set to false still, log the user in, set Used = true, direct them to the homepage or to another URL if one was provided via querystring.</p>
  
  <p>So basically you NEED a complete registered App and secret key and all the jazz for OAuth simply to REQUEST the GUID which allows you to login but only works ONE time and within a 30 second window... and they need to have knowledge of the login URL in the first place, IS THIS GOOD ENOUGH?</p>
  
  <p>In the end if someone can somehow know the GUID and the URL all within 30 seconds they could hi-jack the login, but what are the chances of that?</p>
  
  <p>Alternatively, what could I add to make it more secure?</p>