Microsoft 'Safelinks' (Defender) breaks links.

[meredevelopment]

When a client uses a service like Microsoft's 'SafeLinks', one-use login links are broken. It seems that they effectively get used up by a GET to HEAD request that the link checking service does. Here's some more info on another product having the same issue: FusionAuth/fusionauth-issues#629 (and loads of other repos referencing that issue too).

Anyone found a way around this with this package? Presumably it would have the same impact on Laravel's bundled email verification.

[edgrosvenor]

Does it use an identifiable user agent when it checks the links? If so, we could instruct the package to ignore that user agent when deciding whether to expire a single use link.

[nivv]

Example of the user agent:

{
   "ip":"20.72.100.79",
   "agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.99 Safari/537.36"
}

[meredevelopment]

This has come back, with a vengeance 😅 - It seems more recent versions of Outlook or Defender or something, are pre-checking links a lot more now.

For us, the user-agent is always blank it seem (from request logs) and the IP's vary, as you'd expect I suppose, but do seem to be in the same class B subnet:

104.47.1.254
104.47.30.126
104.47.2.254
104.47.59.254
104.47.66.126
104.47.55.254

Further investigations, and thoughts about how to get around this are ongoing, and I'll update here if I find something useful.