5 ms·
I'm assuming you intend those links to be single-use only and expire automatically, in which case what I'm writing below doesn't apply. Nevertheless, the proble
by radu_floricica 6y ago
I'm assuming you intend those links to be single-use only and expire automatically, in which case what I'm writing below doesn't apply. Nevertheless, the problem is big enough to be worth repeating and re-repeating:
Any link that ends up in a browser address bar should be treated as public.
And no, it doesn't matter if you use HTTPS. Ways to leak it are many, but the gist is that it's treated as "meta-data" and, rightly or wrongly, subject to much lower expectations of privacy. A recent scandal was that several common browser extensions collect this meta-data and sell it to marketing companies.
Which marketing companies offer searchable subscriptions (for hefty prices, true, this isn't a $9.99 service), where somebody could for example search for "yourcompany.com", or even worse, "yourcompany.com/authernticate?token=". Yeah, meta-data.
- squiggleblaz 6y agoHow do you advise we handle email address confirmation and password resets?
- aaronhayes 6y agoAutomatically expire the links
- squiggleblaz 6y agoYeah but you can do that with login token URLs as well. The person I replied to said "you can never do that", not "you can do that only if you exercise suitable caution". I am asking for an alternative that fits with the "you can never do that" perspective, not a way to backpedal.
- squiggleblaz 6y agoApparently I completely ignored the first comment in the original post. Apologies.
- hnick 6y agoI was working on an ecommerce site once and we got emails when customers left reviews/feedback. I forwarded them to customers because it was a convenient way to show their comments then follow up. Then I noticed that some of the text was wrapped in a tokenised link to the platform managing our reviews, bypassing the login screen. Support said they could not revoke these tokens. We had to close the entire account and migrate everything.