Magic links break when Outlook safe links are enabled

[mmmmillar]

Magic links don't work from Outlook when safe links are enabled.

The logs show that the verifyHandler is called multiple times when the link is clicked (as part of the safety check) - the first time the ticket is removed from the user record and redirect is called correctly, but this is cancelled out by the subsequent calls to verifyHandler where the ticket no longer exists and an error response is sent.

The code where this happens is here:

hasura-auth/src/routes/verify/verify.ts

Lines 33 to 62 in 9f5cbbc

	const user = await gqlSdk
	.users({
	where: {
	_and: [
	{
	ticket: {
	_eq: ticket,
	},
	},
	{
	ticketExpiresAt: {
	_gt: new Date(),
	},
	},
	],
	},
	})
	.then((gqlRes) => gqlRes.users[0]);
	if (!user) {
	return sendError(res, 'invalid-ticket', { redirectTo });
	}
	// user found, delete current ticket
	await gqlSdk.updateUser({
	id: user.id,
	user: {
	ticket: null,
	},
	});

[elitan]

I've googled a bit and seems to be a common issue.

• Magic links don't work when Outlook "safe links" are enabled FusionAuth/fusionauth-issues#629 (comment)
• Password reset links don't work when Outlook "safe links" are enabled authelia/authelia#2994
• Signing in using magic link with Outlook email when SafeLinks enabled does not work nextauthjs/next-auth#1840
• https://github.com/nextauthjs/next-auth/pull/3900/files

In summary, I think there are two solutions:

1. Always return 200 for HEAD /verify: router.head('/verify', (_, res) => res.sendStatus(200));
2. Don't delete tickets after they've been used, but instead allow tickets to be reusable until they expires.

If we could try solution 1. and check if it works I think that would be the cleanest solution for now.

[Haraldson]

@elitan Did that actually fix the problem? I’m in a similar situation now, and from what I gather reading a lot of issues and tickets all around, it shouldn't have worked?

[elitan]

I think it was fixed yes.

Did you experience something else?

[Haraldson]

I haven’t really tried it out yet, but I was asking due to comments such as the ones on this StackOverflow issue, where disabling HEAD requests was said to not work. However, returning a smile and a thumbs up like your fix here might work [differently].

[lordkev]

Unfortunately, this solution no longer works. In my testing, Outlook makes actual GET requests during its link scanning, not just HEAD requests.

[kelkes]

I've got the same problem with magic links. Links are invalid before the user got the chance to click it.

[dbarrosop]

We wrote about this issue recently:

https://nhost.io/blog/protect-magic-links-from-email-clients
nhost/nhost#2590