Email login does not work if security scanners open the links first
Some mailboxes have security scanners that open all the links in incoming mail.
That invalidates exe.dev token links, making login impossible, with no workaround I could find.
The solutions I can think of are all isomorphic to "trying to evade the security scanner by showing a different result to the human" and so should not work, but I am also probably wildly overestimating these scanners. Maybe just a bit of Javascript to actually reddem the token will do.
Otherwise, make them expire after an amount of time instead of after one use.
4 Comments
I believe I’ve fixed this. If your email scanner is evaluating POST requests, we might have to do bigger tricks and please let me know if that’s the case.
This was encountered by a partner that has since allowlisted exe.dev as a workaround, so I can't easily check, sorry!
(I am curious, what do you mean by evaluating POST requests?)
We had one workflow where the verification was happening when the user did a GET. The other workflows (and the remaining ones) require a POST after the GET. It mostly happens "magically" because we use JS to trigger the POST. We should never have been using GET!
Thanks!
Oh makes sense! We can hope/assume these scanners don't run the Javascript on the page.