Our web application sends a one-time use generated token, in the form of an URL, to clients who forget their passwords. This works except for the case where the client is sitting behind another server that scans their email for URLS and does a GET on the URL. I'm assuming the server is checking for a malicious payload.
The client opens the email and clicks on the link, but obviously nothing happens because the token is invalid at that point.
I can think of some ways of handling this:
• Instead of expiring immediately, allow the token to be valid for a certain time period. Disadvantage: This circumvents the whole point of a one-time use token since the token can be used multiple times. Plus it may not solve the problem if the user decides to open their email PAST the expiration time.
• Make the token good for two uses. Disadvantage: similar to the above. What if the spam checker "checks" the URL again... Sigh.
Anyways, I'm looking for some wisdom here on how to handle this. If there are better ideas than what I've proposed I'd love to hear them.
EDIT: I cross-posted this at programmer.stackexchange. Go there for a little more discussion, but the answer I selected below is basically the same answer.