8 ms·
Make the user take action after opening the link. Like click a button.
by whateveracct 5y ago
Make the user take action after opening the link. Like click a button.
- _wldu 5y agoThanks. That's good advice.
- weird-eye-issue 5y agoBtw you could just have JS do a POST request, the user doesn't need to do anything except open the page. This is how unsubscribe pages work.
- kevin_thibedeau 5y agoThat presumes everyone executes random JS or has a browser that supports it.
- aendruk 5y agoIt should go without saying that you provide a fallback.
- input_sh 5y agoCreate a "click here" button, hide it by adding it a class or a style with JS.
- kevin_thibedeau 5y agoThere is this thing called an HTML form. Every browser supports it.
- bawolff 5y agoDepending on context and implementation details, this can often be a security issue (csrf or something similar). Probably not in the unsubscribe case though
- weird-eye-issue 5y agoObviously you need to make sure your API is not susceptible to CSRF but that goes without saying... Should I also tell him to password protect his database? :P
- bawolff 5y agoIf you follow what the parent is suggesting (open a page with a get request that has js which does a post request automatically with no user interaction), its probably impossible to not be susceptible to csrf
- weird-eye-issue 5y agoI'm really not sure why you think that, but that's just not true at all. For starters, if it is a JSON API then a CORS request will be done for all cross-domain API requests. Even a missing CORS configuration would then block the CORS request from third-party domains.
- bawolff 5y agoSo the situation is: there is some url you open (with a normal get request. Typically but not neccesarily from an email), then that url does the non-idempotent POST request without any futher user interaction. A malicious page that knows the url used in the email could open the url from the email in a popup. The js will execute in the popup, and do the POST request. It doesn't matter how much csrf protection you have on the POST step, if anyone can trigger it with no user interaction just by opening some page with a GET request.
- weird-eye-issue 5y ago> A malicious page that knows the url used in the email could open the url from the email in a popup Sorry but this whole scenario is just ridiculous. If somebody can access your email it is already game over. It doesn't matter what web technology you are using at the that point, user interaction or not. If a "malicious page" knows the URL it doesn't matter at all because it means it is capable of arbitrary code execution and that point it could just exfiltrate the URL to somebody or a Chromium instance to perform the user interaction. Actually if the page can open a popup I think it could also execute JavaScript within the context of the page and perform the user interaction right there.
- _wldu 5y agoThanks. I don't use JS, just Go with HTML templates. I populate the form now with {{ .code }} from the URL so the user does not have to copy/paste the code. But they do have to click 'Submit' to post the form. I think this is a reasonable approach that most users are OK with.
- weird-eye-issue 5y agoYou could add a single line of JS to have it auto submitted as well
- _wldu 5y agoWouldn't that be equivalent to just doing a GET?
- SamBam 5y agoNo, because if you curl the original url the POST for the second url won't be triggered, but if you navigate your browser to the url, the browser will trigger the POST.
- weird-eye-issue 5y agoNo... Because you have to do a GET, execute JavaScript, and make a POST request. Bots don't execute JavaScript and no well-behaved bots are going to make POST requests
- sxp 5y agoAnd make sure the action is a POST instead of a GET. GETs should never modify important state.
- darig 5y agoEmail should never rely on HTML forms that can POST.
- sleavey 5y agoThis is the correct answer. Just because the norm is to embed verification hashes in URLs to be clicked, doesn't mean it's the right way for it to be done. Why not send a short random code by email for the user to then copy into the sign-up form they were in the process of filling in?
- vbezhenar 5y agoIt takes more effort and more users will decide to move elsewhere. I don't really believe that if someone can't bother to copy code from e-mail, he's worthy to have as a client, but some company are obsessed by metrics and percentage of successfully registered users is one of those metrics.
- toshk 5y agoI understand your way of thinking, but we ended up having a flow for a government site where users had 2-3 steps what normally could be done in 1. Also many were not tech savvy and confused. So we ended up adding JS to automate the click.
- inetknght 5y agoYou automated a click on a government website? So tell me: how'd that audit go?
- acdha 5y agoThis depends on your willingness to turn away business, and may not even be legal depending on where you work. In the United States, I would not want to defend that copy and paste scheme as being compliant with the Americans With Disabilities act having seen usability tests from people trying to accomplish that exact workflow using screen readers. Remember that things like cognitive impairments count and, like vision and motor control/range of motion, most of us will be affected at some point in our lives. What I do think would be reasonable is having a well-labeled link which takes you to a confirmation form: someone can follow it easily and choose to submit it with far less friction and it leaves standard web semantics intact.
- deleted 5y ago[deleted]
- bradknowles 5y agoMake the link password protected, and they don’t get the password in the same e-mail message. Kinda hard to pre-scan a URL if you can’t provide the password for it.