One-time login link in asp.net identity : <p>Some mobile apps like slack have popularized the idea of allowing your users to get a one-time use login link (Slack calls this the magic login link). </p>

<p>The idea is that you enter your email and instead of having to enter your password of a mobile, you request a magic login link that can be used once to log you in by opening that link on your phone.</p>

<p>I'm implementing this in asp.net identity 2.1, and I'm unsure how to ensure that the link that's generated can only be used once.</p>

<p>I generate a token like this:</p>

<pre><code>var token = await _userManager.GenerateUserTokenAsync("MyLoginLink",user.Id);
</code></pre>

<p>This token is added to a URL for the user. The action method that the link redirects you to checks that the link is valid for that user, and then logs you in:</p>

<pre><code>public async Task&lt;ActionResult&gt; LoginLink(string email, string token)
{

    var user = await _userManager.FindByNameAsync(email);

    // some checks ommited

    //check for an expired token:
    var result = await _userManager.VerifyUserTokenAsync(user.Id, "MyLoginLink", token);
    if (!result)
    {
        // Failed
        return RedirectToAction("Login");
    }

    await _userManager.UpdateSecurityStampAsync(user.Id);
    await SignInAsync(user, true);
</code></pre>

<p>Now - if I update the security stamp with <code>user.UpdateSecurityStamp</code>, that re-generates the security stamp, which will invalidate this token, and ensure it can't be used again. The problem with that is that it also invalidates any existing logins, so if the user is also logged in on a desktop, they'll be forced to logoff and on again.</p>

<p>Is there a relatively simple way to create one-time use token like this in asp.net identity, that doesn't invalidate all existing logins?</p>
