3 ms·

> These days there's also to consider that some Mail Threat Protection Tools (at least Microsoft Defender in Exchange Online does this) click links in Mails to

• sbarre 2y ago
  It's not actually insane if the application hosting the link follows the principle that GET requests should not mutate state. This problem is ~20 years old from when CMS platforms had GET links in the UI to delete records and "browsing accelerator" browser extensions came along that pre-fetched links on pages, and therefore deleted resources in the background. At the time the easiest workaround was to use Javascript to handle the link click and dynamically build a form to make a POST request instead (and update your endpoint to only act on POST requests), before the fetch API came along.
  • littlestymaar 2y ago
    It is insane because it brings literally nothing security-wise (an attacker can easily detect that the link is being opened from something else than an end-user's browser, and not deliver the payload) while actualy compromising the security of their users (by allowing an attacker to know which addresses exist and which do not, which is very useful if you want to attack companies).
    • saagarjha 2y ago
      The idea is that the pre-fetching is done by an environment that looks similar to the end-user's browser.
    • ctm92 2y ago
      It does not only show to attackers that your address exists, it also shows that it is hosted on Microsoft 365 and is ATP is licensed.