Secure email verification

Question

I want to send a template email to perform email verification of our users.

The template email should contain a link which need to call http POST request to somewhere. And than from third party API (ex. elasticemail) handle that request via JavaScript and do another POST request to the actual server.

My question is: How can I do this?

We need this kind of step in email verification process, because otherwise we have to expose private data inside email template.

score 2 · Answer 1 · answered Mar 17 '18 at 13:14

2

The template email should contain a link which need to call http POST request to somewhere

Sorry, this is not possible. When a user clicks on any link the browser will always do a HTTP GET request.

But you can assign tokens (or random strings) to uniqly identify the email address. So there is no private data leaked.

answered Mar 17 '18 at 13:14

rollstuhlfahrer

3,988
9
25
38

Great suggestion RE tokens. Even if there was a way to embed POST in an email, the payload wouldn't be any more secure than a GET query string, because the weak point is the email contents being sent through SMTP servers, frequently in clear text. – David784 Mar 17 '18 at 14:03

score 0 · Answer 2 · answered Mar 17 '18 at 13:13

0

I advice that you just create a simple email that has a link to the page with the functionalities you outlined. Append the url with a random or jwt string that you can use to identify which user has arrived to the page.

answered Mar 17 '18 at 13:13

Tendai

100
8

Secure email verification

2 Answers2