I've implemented a passwordless login using a magic link and email. The link can be used only once. One customer is complaining that once they click the link, the page reports that the link is already used. This is indeed what I implemented, but I'm convinced they actually click each link just once. I was in direct contact with the user.
We cannot reproduce this behavior (it works on my computer), so I checked the logs. From what I gathered from the logs, I suspect that some automated mechanism is clicking the login-link before delivering the email to the inbox. Once it reaches the inbox and the user clicks on the link, they're actually the second one clicking it. Some automated tool did it first, then the user does it second.
Here's what raised my suspicion in descending order of contribution:
- there's an average of 2 seconds between submitting the email address and clicking the link in the email. Albeit not undoable, it takes some unlikely amount of effort to accomplish that by hand.
- the email address was submitted from a completely different IP address from where the link was clicked. Geo-IP tells me that requests are all made in London, but the link is clicked in the US. Same user, next attempt 5 minutes later request from London, but this time clicked in Germany.
- the email address was submitted from a different browser than the browser used to open the link (Chrome vs IE11).
Do mail servers actually follow links in emails as part of a security scan before inbox delivery? If so, what's a recommendable way to make one-time links work when used with such environments?
PS1: This customer works for a large multinational company. PS2: I'm aware of the pros and cons of passwordless logins.