Hacker News Reader

Comment by exabrial | Hacker News Reader

In a previous life, we prevented the GET url problem by having a javascript POST and forward to a secondary URL.

This allows everything to be "one click" (which honestly is a good thing) but prevents crawlers from accidentally triggering the unsubscribe.

Not sure this still works today and obviously this is not legal advice.

View on HN

It seems like the more ideal solution would be to block the malicious IPs instead of lowering the accessibility of your site, no?

I think some crawlers run JS, because a lot of the web simply won't work without JS to initialise the page state these days.

You can use captcha or similar, one workaround I've seen has a submit that is hidden so never clicked by real people then a visible submit that sets a hidden input and clicks the other one which requires the hidden input... not foolproof but avoids some accidents.

A crawler that follows links found in emails and sends POST requests / submits forms will cause so much havoc. It could buy things, validate account sign-ups, delete data, etc. I have a hard time believing the answer isn't to ask users to switch to a normal email provider.

I know web search at least runs JS to get better results. Not sure about email pre-fetch but I assume they do. I don't think crawlers click buttons though unless they are malicious so it's probably fine for unique email links.

Not an answer to the question they asked.

---

Okay, HN. Go ahead and explain what's offensive here.

The question that was asked: "I noticed that MSFT IPs hitting my unsubscribe links with invalid identifiers on the [query] string. Anybody ever seen that?"

The question the parent commenter seems to have hallucinated: "Does anyone know how we can keep mail services from unsubscribing folks in error when these mail services scan our subscribers' emails, but also still offer our subscribers 1-click unsubscribe?"

You could imagine they started their post with "Yes, it's a pretty common problem here's what we did ..." and then it makes sense.

No, it doesn't. The original questioner is already aware of the extremely common phenomenon where mail providers scan links in emails. That's not what the question is about. The first comment contains a very specific question about something different. The response is derailing the discussion.

Reply on news.ycombinator.com