> Microsoft’s security scanning will now not only visit the links you mail out, they will also run the JavaScript on your page, and will also send out any POSTs generated by that JavaScript:
It seems to me that someone misunderstood how to implement the logic on the frontend here. You're not supposed to send off a POST request directly as the page has been loaded to exchange the tokens, but require the user to click on a button to confirm the activity.
So the flow would be:
- "Send email with url+token > Frontend loads, shows button to user to confirm > User clicks button and exchange happens".
Instead, wrong implementations do something like this:
- "Send email with url+token > Frontend loads and exchange happens", which we've known for years to not work correctly, because of this very issue.
Discourse for example implemented this perfectly, so if you need an example, that would be where I'd go.
(I know it sucks that scrapers/crawlers do a lot of horrible shit, it truly does. But we've dealt with this for years now, it's not a new thing and it won't be the last shitty thing they do)
It seems to me that someone misunderstood how to implement the logic on the frontend here. You're not supposed to send off a POST request directly as the page has been loaded to exchange the tokens, but require the user to click on a button to confirm the activity.
So the flow would be:
- "Send email with url+token > Frontend loads, shows button to user to confirm > User clicks button and exchange happens".
Instead, wrong implementations do something like this:
- "Send email with url+token > Frontend loads and exchange happens", which we've known for years to not work correctly, because of this very issue.
Discourse for example implemented this perfectly, so if you need an example, that would be where I'd go.
(I know it sucks that scrapers/crawlers do a lot of horrible shit, it truly does. But we've dealt with this for years now, it's not a new thing and it won't be the last shitty thing they do)