It's quite simple actually: The user wanted to delete their account, but forgot their password so they requested a password reset. Before the password reset email was delivered, the user remembered their password and deleted their account. The password reset email is finally delivered and apparently some email clients open all the links in the background for whatever reason, so it wasn't actually the user who clicked the password reset link.

[–] [email protected] 21 points 3 months ago (5 children)

apparently some email clients open all the links in the background for whatever reason

What? Really??

[–] [email protected] 35 points 3 months ago (3 children)

Yes, e.g. outlook replaces links in mails so they can scan the site first. Also some virusscanners offer nail protection, checking the site that's linked to first, before allowing the mail to end up in the user's mail client.

Thats why you never take actions on a GET request, but require a form with button for the user to do a POST.

[–] TrumpetX 11 points 3 months ago (1 children)

It can be worse, we had to add a captcha for those link scanners cause they'd submit the forms and invalidate tokens too:(

[–] [email protected] 4 points 3 months ago

Wow. That sounds terrible. Good to know.

load more comments (1 replies)

load more comments (2 replies)