Crypto noob here. I have an application that has only moderate security requirements (internal use, limited audience). I want to send a unique url with a token in it to each user. If anyone has the url, they can submit information on the user's behalf.
Can I just hash their email with a secret salt to produce the same token every time? I realize these won't expire, and knowing the token lets anyone spoof the user, but these are acceptable for my application. When they submit information, I'm thinking I can just re-hash their email with the secret, and make sure it matches the submitted token.
Is this a bad idea? Which hashing algorithm should I use? Should I change my approach?