Magic link authentication in Supabase - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

Magic Link Email Behavior

When a user requests a magic link for authentication in Supabase, what happens immediately after the request is made?

A The user receives an email with a permanent link that can be used multiple times.

B The user receives an email with a link that expires after a short time and can be used only once.

C The user is logged in instantly without any email sent.

D The user receives a text message with a code instead of an email.

💡 Hint

Think about security and temporary access.

Supabase sends a magic link email that expires quickly and can be used only once to ensure secure login.

❓ Configuration

intermediate

Configuring Magic Link Expiry

Which Supabase configuration setting controls how long a magic link remains valid before expiring?

A auth.email.link_lifetime

B auth.magic_link.expiration_time

C auth.email.link_expiry

D auth.email.confirmation_expiry

💡 Hint

Look for a setting related to email confirmation expiry.

The correct setting is auth.email.confirmation_expiry, which defines the magic link expiry time.

❓ security

advanced

Preventing Replay Attacks with Magic Links

Which practice best prevents replay attacks when using magic link authentication in Supabase?

A Invalidate the magic link immediately after the first successful use.

B Use a static magic link URL for all users.

C Send the magic link over unsecured HTTP to speed up delivery.

D Allow magic links to be used multiple times within their expiry period.

💡 Hint

Think about what happens after the link is used once.

Invalidating the magic link after first use stops attackers from reusing the link.

❓ Architecture

advanced

Magic Link Authentication Flow

What is the correct order of steps in the magic link authentication process in Supabase?

A 1,2,3,4

B 2,1,3,4

C 1,3,2,4

D 3,1,2,4

💡 Hint

Think about the natural sequence from request to login.

The user first requests the link, then receives it, clicks it, and finally is logged in after verification.

✅ Best Practice

expert

Handling Expired Magic Links

What is the best way to handle a user clicking an expired magic link in a Supabase application?

A Automatically log the user in anyway to avoid frustration.

B Redirect the user to the homepage without explanation.

C Show an error message and provide an option to request a new magic link.

D Delete the user's account to prevent security risks.

💡 Hint

Consider user experience and security.

Informing the user and allowing them to request a new link balances security and usability.