“Magic links” can end up in Bing search results, rendering them useless

Re:“Magic links” can end up in Bing search results, renderin... by noisem4ker on Monday June 27, 2022 @09:33AM (#31894384)

The HTTP GET method is idempotent by specification. Visiting a webpage should not trigger password resets or any other actions by itself. If that's a problem then it's the site's fault for being defective.

[ Parent | on HN ]

Re:“Magic links” can end up in Bing search results, renderin... by rsbadger on Monday June 27, 2022 @09:42AM (#31894483)

You’re right that it was a bit of an oversight on my behalf, as the links were only generated after a verified human user action (signup) I had assumed the 1 time links to their email would be safe. But regardless of the link action, it shouldn’t be passing that data to Bingbot to crawl and (possibly) index in search engine results. Private email data should not be shared with search engine crawlers IMO.

[ Parent | on HN ]

Re:“Magic links” can end up in Bing search results, renderin... by petercooper on Tuesday June 28, 2022 @06:15PM (#31913780)

So how do you implement a "one click unsubscribe" link in an email? They're on GET requests. You could use JavaScript on the resulting page to then trigger the unsubscribe but bots are now running JavaScript as well.

[ Parent | on HN ]

Re:“Magic links” can end up in Bing search results, renderin... by noisem4ker on Thursday June 30, 2022 @07:11AM (#31930964)

You show a webpage with an "Unsubscribe" button in it. The button triggers a POST request.

There's also RFC 8058: https://datatracker.ietf.org/doc/html/rfc8058

[ Parent | on HN ]