**Since newsletters are often forwarded (and in fact successful ones encourage it!), what's the conventional wisdom on the security of unsubscribe links?**

It's common practice to provide an unsubscribe link at the bottom of every newsletter or newsletter-like email sent to consenting customers, along with a `List-Unsubscribe` header. Unsubscribe links should include a cryptographically-secure token indicating which subscriber to unsubscribe.

The link often unsubscribes the subscriber immediately (instead of asking confirmation, either through a dialogue or sending an email with a confirmation link), and will often provide a follow-up dialogue allowing the subscriber to unsubscribe from additional newsletters they're also subscribed to from the same website, or resubscribe if unsubscribing was an accident.

**So what is the convention when it comes to unsubscribe links?**

Is it just user-beware: That if the user has forwarded the email, they're accepting the risk of a recipient unsubscribing them from that and any other newsletters? Should unsubscribe events trigger a notification email? Or is there a special unforwardable element that email clients remove from emails when forwarding them?

Overall, this is a relatively trivial security vulnerability, but I am wondering if this has been considered much before and, if so, what convention dictates. (The problem is briefly referred to in [this question and answer][1] and, while I agree that the problem is trivial, I'm still interested if anyone has developed a solution.)


  [1]: https://security.stackexchange.com/a/115966/229734