5 ms·
That's why it should not be HTTP GET endpoint. Get endpoint should only be when request is idempotent. Use HTTP POST for your usecase.
by vs4vijay 5y ago
That's why it should not be HTTP GET endpoint. Get endpoint should only be when request is idempotent. Use HTTP POST for your usecase.
- mnahkies 5y agoIs it possible to embed a link that uses POST in an email? I can't think of a way unless form tags work, but then the link wouldn't work in a plain text email reader
- harg 5y agoYou’d need to send the user to the verify page and populate a form with their token from the url. Then submit the form, either automatically or by getting the user to manually hit a button.
- timwis 5y agoThis is how mail chimp does it, I believe. JavaScript to submit the form automatically.
- miken123 5y agoYou should not submit the form automatically. Tools like Microsoft O365 ATP run any links in an emulated browser with Javascript support. These will, in some cases, happily autosubmit the form for you.
- toshk 5y agoWe've done this for over 2 years now, and over 200k users never ran into this. Also not within government users.
- bombcar 5y agoTurn on O365 “link scanning for malware” and Salesforce onetime links for password resets etc stop working.
- miken123 5y agoIt could very well be that your specific Javascript does not run automatically or does not run correctly. I see the same with one of our auto-submitting forms. I do not know whether or not that is intentional on Microsoft's part. But other users have had different experiencies, so be aware that Microsoft may 'fix' their issue on some day and all of a sudden all your users will start clicking/unsubscribing/whatevering automatically. See https://blog.healthchecks.io/2019/12/preventing-office-365-atp-from-clicking-unsubscribe-links/ https://blog.healthchecks.io/2019/12/preventing-office-365-a... for someone who did have this experience.
- addingnumbers 5y agoHow do you know your users have never run into this? People don't tend to report problems like "my account was activated sooner than I expected"
- toshk 5y agoWe use it to log in users. We quickly get complaints if something doesn't work well.
- addingnumbers 5y agoBut your users ought to believe it works well to have google's servers respond to the activation link instead of requiring them to click it themselves, so no complaints. The verification process serves only you, the administrator. To everyone else it's a tedious obstacle. Nobody will reach out to you to say "I made it through the registration process just fine but it was slightly less burdensome than I expected, is everything OK?" If you want to know if Google is hitting your activation URLs, check your access logs. Your users will almost certainly not realize it happened. Even if they do notice it, there is no impact on them and no motivation to inform you. You would have to be extremely lucky to hear about it from a user.
- clusterfish 5y agoHalf of unsubscribe links seem to auto-submit. Are they all broken in O365?
- janci 5y agoYou can use <form method=POST> in email body (obviously does not work in plaintext mode)
- chrisshroba 5y agoI this sometime triggers a warning to the user (something like “Are you sure you want to submit form data to external site?”), which may not be the best end user experience.
- inetknght 5y agoYou're assuming the email is HTML. No, not all users use HTML email.
- detaro 5y agoWhat do you think the second sentence of their comment is talking about?
- bawolff 5y agoDepending on how your app works, non-idempotent links in emails can often be an over-looked csrf vector. Sometimes people also make such links auto log people in which can be problematic.
- Tade0 5y agoThis endpoint is idempotent - clicking that link multiple times has the same effect as doing it once.
- account42 5y agoPresumably there is a different content for the first response when the token is still valid, otherwise this would be a pointless link.
- tantalor 5y agoNot if it "disappears after access"
- shadowgovt 5y agoCorrect. Idempotency isn't precisely the right concept to appeal to here. The right concept is that GET requests are assumed by convention to be "safe," which implies they aren't tied to user interaction. "...user did not request the side-effects, so therefore cannot be held accountable for them" (https://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html#:~:text=user%20did%20not%20request%20the%20side-effects%2C%20so%20therefore%20cannot%20be%20held%20accountable%20for%20them https://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html#:~:te....).
- xunn0026 5y agoI was just wondering if a web page that counts visitors is idempotent. Not?
- Filligree 5y agoIt changes state on the server, i.e. the counter. So no.
- mananaysiempre 5y agoI’d say it depends on what the counter is for. If it’s used to bill the user per pageview, then it’s user-visibly not an idempotent action, so no. If it’s used to estimate site speed, then the user doesn’t care, so yes. (In fact, analytics is the example I see most often under “non-idempotent stuff it’s OK to do on a GET”.) If it’s used to display a counter in the site footer, then you might wish the user cared for your bragging, but they probably don’t, so yes with a disapproving glance in your general direction.
- motoboi 5y agoWell, this is why your email provider should not open your links for you. Use a different email provider instead.
- shadowgovt 5y agoI think I'm going to continue using the one that is pre-opening links that should be idempotent so that it can check them against its heuristics for spam or phishing. That's been really nice to have. And I'll instead refrain from using sites that inappropriately provide bare get URLs that are really state-mutating booby traps in disguise.
- mat0 5y agoLol, the nerve of the other reply: "stop using the most widely used email provider in the world". I liked your reply better