View Issue Detail

ID	Project	Category	Submitted / Last Updated
01297	UserSpice	Misc	2021-08-11 07:37:39 / 2024-03-18 08:29:04
Reported	John Van der Wulp	Assigned To	Unassigned
Priority	none	Reported	5.3.4
Status	closed	Resolution Version and Commit
Summary	Office365 makes verification fail (but not actually)
Description	Hi, I have setup this framework for an internal simple project. One thing I have issues with is the following: When user registers an account verification email is send. Since we have office365 urls are translated/encoded with https://eur02.safelinks.protection.outlook.com/ If the user clicks the link the 1st request is causing the user to be verified. This is done by the outlook protection and not seen by the end user. The 2nd request is seen by the user and telling him that verification is failed. During the 1st request a new vericode is generated and does not match the 2nd request. For our application i modified the 'verification.php' line 48 from: if($verify->data()->email_verified == 1 && $verify->data()->vericode == $vericode && $verify->data()->email_new == ""){ to: if($verify->data()->email_verified == 1 && $verify->data()->email_new == ""){ to display the verified succes message. John

November 2021

Your workaround effectively disables email verification as you could verify any email address without the code. It seems from threads that Microsoft makes a HEAD request which loads the page including javascript to be able to verify the contents of the page. While you can technically ignore HEAD requests so that they don't verify, services like Mimecast make a GET request. A lot of services are requiring you to log in / be logged in on verification to combat this spam filter safelink trigger of these links, this would most likely be the most effective upgrade.