I’ve to expose an externally accessible (open – no auth) for my web application.
A signed-in user can generate a shareable link to an entity (say, a document) and share it with a friend [email protected]

An email link will re-direct the friend to ext.myWebApp.com/generateLink where they can generate a signed url that lasts 15 mins.

To know the state at any time, my GenerateLinkServlet can consume information in 2 ways from query params:

ext.myWebApp.com/[email protected]&documentId=999&[email protected]

or

ext.myWebApp.com/generateLink?context=signedJwtToken, where the jwt token contains same information

I don’t mind someone manipulating the parameters in option 1 because I have strict validation on whether a certain document is shared with the friend or not.

GenerateLinkServlet will create a 15-min new link and send it to the friend via email again.

ext.myWebApp.com/access?authToken=000&[email protected]&documentId=999&[email protected]

or

ext.myWebApp.com/access?authToken=000&context=signedJwtToken

What is the best practise here? Option 1 looks clear but in option 2 I don’t have to make major changes every time a new query param needs to be added.