What it is
Email links bridge an untrusted message-rendering environment and a web application. The link itself may carry a short-lived capability or only a route to authentication.
Why it matters
Misleading labels train recipients to ignore phishing signals. Long-lived bearer URLs leak through forwarding, logs, previews, and referrers.
How to implement
Use HTTPS, recognizable first-party domains, honest link labels, short-lived single-purpose tokens, and server-side checks before sensitive changes. Offer a path through the normal site for cautious users.
Common mistakes
- Showing one domain while linking to another.
- Putting personal data or permanent credentials in query strings.
- Completing destructive actions on a GET request.
Verification
Inspect rewritten delivered URLs, follow them while logged out and in the wrong account, reuse expired tokens, and confirm state changes require the intended authorization.