Original Summary

A customer at a large company wrote that our sign-in link just dropped them on the homepage. The database told the story: that morning they had asked for two links, both were marked as used within minutes, and neither turned into a login. What happened: their company's email security opens every link in incoming mail to check it. Our link signed you in on a plain GET, so the scanner's visit used it up. When the person clicked, the one-time code was gone, and our fallback sent them to the homepage without saying why. The fix: Opening the link (GET) only checks it and shows a page with a Sign in button. Nothing gets used up. Only the button uses the code, with a POST from our own page. A POST from another site doesn't count. A used or expired link now says so and offers a new one, instead of a silent redirect. The page isn't cached, can't be framed and loads no third-party scripts, because the URL carries the code. One thing I only caught by testing in a real browser: a double click on that button sent the code twice. The second request found it already used, and the person landed on "This link no longer works". A few lines of JS that ignore the second submit fixed it. Without them I would have shipped a new version of the same bug. If you email sign-in links to business addresses, check what a plain GET does. Has anyone run into scanners that also submit forms? (The product is EventQuiz, a live quiz tool for events.)   submitted by   /u/Entire-Protection246 [link]   [comments]

  • 情报分类：综合情报
  • 分类依据：内容未命中明确的垂直分类规则，归入综合情报
  • 信息来源：Reddit · SaaS
  • 发布时间：2026/10/14 15:32:17