Gmail is opening and caching URLs within emails without user intervention (2019)

Re:Gmail is opening and caching URLs within emails without u... by wutbrodo on Friday August 20, 2021 @12:35PM (#28248025)

Ah interesting, so you're saying that GMail is not likely to be avoiding the POST requests if they're in the JS code? I have a passing, non-professional familiarity with Web practices, so this isn't something I have a great intuition for.

[ Parent | on HN ]

Re:Gmail is opening and caching URLs within emails without u... by nickjj on Friday August 20, 2021 @02:02PM (#28249304)

The basic flow would be:

    - You GET /reset/abc123
    - Your server responds back with a page that has a form
    - There's a hidden field with the token
    - Javascript kicks in and on page load executes the form as a POST request
    - Your server responds to that POST request and does whatever it needs to do

All of that is kicked off by gmail visiting /reset/abc123, and now it comes down to whether or not gmail's pre-visiting code will run the JS on the page. If not, then the above workflow fixes this issue, if it does then you're in the same position as avoiding all of this and having a GET /reset/abc123 perform the destructive action.

[ Parent | on HN ]

Re:Gmail is opening and caching URLs within emails without u... by wutbrodo on Friday August 20, 2021 @02:30PM (#28249663)

Right, it's the second part of the fourth bullet that I was asking about. Basically, that it sounds like it isn't feasible for Google to avoid POST requests if they're being submitted from JS.

[ Parent | on HN ]