mirror of
https://github.com/GSA/notifications-admin.git
synced 2026-03-15 07:42:41 -04:00
3e6d9a564b
Some email clients will pre-fetch links in emails to check whether they’re safe. This has the unfortunate side effect of claiming the token that’s in the link. Long term, we don’t want to let the link be used multiple times, because this reduces how secure it is (eg someone with access to your browser history could re-use the link even if you’d signed out). Instead, this commit adds an extra page which is served when the user clicks the link from the email. This page includes a form which submits to the actual URL that uses the token, thereby not claiming the token as soon as the page is loaded. For convenience, this page also includes some Javascript which clicks the link on the user’s behalf. If the user has Javascript turned off they will see the link and can click it themselves. This is going on the assumption that whatever the email clients are doing when prefetching the link doesn’t involve running any Javascript. This Javascript is inlined so that: - it is run as fast as possible - it’s more resilient – even if our assets domain is unreachable or the connection is interrupted, it will still run
26 lines
525 B
HTML
26 lines
525 B
HTML
{% extends "withoutnav_template.html" %}
|
|
{% from "components/page-header.html" import page_header %}
|
|
{% from "components/page-footer.html" import page_footer %}
|
|
|
|
{% block per_page_title %}
|
|
Sign in
|
|
{% endblock %}
|
|
|
|
{% block maincolumn_content %}
|
|
|
|
<div class="js-hidden">
|
|
|
|
{{ page_header('Sign in') }}
|
|
|
|
<form method="post" id="use-email-auth">
|
|
{{ page_footer('Continue to dashboard') }}
|
|
</form>
|
|
|
|
</div>
|
|
|
|
<script type="text/javascript">
|
|
document.getElementById("use-email-auth").submit();
|
|
</script>
|
|
|
|
{% endblock %}
|