1

I heard that there are some university campus email systems that "click" all the links on incoming emails and thus inadvertently unsubscribe recipients from email distribution lists if the email contains a one-click unsubscribe link. Does this exist? Has anyone had first-hand experience with this from either sender, campus IT or recipient end? Is it then possible to get whitelisted by such systems?

I'm having a hard time believing this exists. It would overturn the wishes of all the recipients who willingly subscribed. Are there any negative security implications in doing this?

Improve this question
3
  • This sounds like an X/Y problem. Yes, some link checking programs actually visit the URL with the POST parameters in the URL. Or at least it was a problem in the past. Why do you want to get "whitelisted"? It sounds like you are trying to solve another problem.
    – schroeder ♦
    Commented Apr 21, 2020 at 23:13
  • As a sender the problem I'm trying to solve is that I don't want my recipients unwittingly unsubscribed.
    – Sushil
    Commented Apr 22, 2020 at 3:09
  • Ah, then the power to prevent this is actually in your hands
    – schroeder ♦
    Commented Apr 22, 2020 at 7:08

1 Answer 1

Reset to default
2

In theory this should not happen.

But for short periods I can see it happening, in certain not carefully tested systems.

The http standard includes the following actions, HEAD, GET, POST, DELETE and a url can use any of these.

The default GET is what we are talking about here, and GET requests should not actually action anything. Theory being a GET should retrieve the resource, not changing it in the process.

Of course this is not in practice followed, such as these common unsubscribe links.

So in practice urls should not be retrieved by GET without user action except in certain exceptional cases.

Even using the HEAD action may impose security concerns such as unequivocally identifying a valid email address.

Example

Google had a pre-caching service at one point (VPN or Browser or something) that prerequested website urls to improve performance/bandwidth. This caused certain web-apps to malfunction in similar ways to the Question.

For instance I developed a web-app around 2000 that used GET urls to do actions such as delete record an so forth, not a mistake I would repeat of course.

This pre-caching service looked at the urls and web site and inferred that it should NOT pre-cache certain links using a heuristic with inputs such as is this an authenticated site, is it https, is the url containing the string DELETE or UPDATE etc or identifying the web framework used for the site.

I dont know how accurate the heuristic was, I heard of some issues raised in this system but I dont know the detail.

Because this is a easy mistake to make on any web site (beware web coders) be very careful of implementing this feature.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .