Normal Login process has been working fine.
There is even a guest account with a simple password that only has access to 2 pages. The admin wants other staff to access these 2 pages only for now. he is being very protective 
The admins (2 Operational Managers) need to send a link to staff to look at an updated page. For now, one of the above. The pages are
- Notice Board
- Daily Run Sheet (Summary of all assets and staff usage/booking/repairs etc).
I see 3 options
- It auto logs you in as a Guest - this could be open to abuse, if the url becomes public.
- The link has an embedded token - this expires after a few days. As a user I hate this.
- It saves the page id, goes to the login page and then shows that page.
I am thinking of letting the admin choose 2 or 3 at the time of sending a link
- It’s more work.
- For #3 to work, I really need to implement Autologin for a pleasant experience.
AutoLogin
- I seem to recall that it’s illegal to fingerprint/identify an Apple device. Without doing this, the cookie/local storage could be copied and abused.
- I could implement a rotating shortlived token that gets refreshed on login. If they haven’t logged in for say a week, it expires.
- They want a TFA using Microsoft authenticator, when it goes live. I could implement this first. As a user, I hate this if I have to do it multiple times a day. So we are back to storing something in the browser.
How have others handled this?