I am currently planning to create an application. So far I have always been using the traditional username/password approach. But I would like to get rid of passwords for user authentication. This would avoid to worry about weak, stolen and forgotten passwords.
I want to create a passwordless signup and signin with magic links, but I wonder if my approach is appropriate or too risky compared to the traditional approach:
SIGNUP: User needs to post email for registration. Short lived magic link is created in DB/cache and sent to the provided email. If user clicks on the link before link get's expired he/she is validated.
SIGNIN: Same process as signup. Short lived magic link is created and if clicked on time, user is provided an JWT token to be used as a bearer token. When JWT expires, all you need to do is request a new magic link which will sign you in.
Will this work?