Safe and trustworthy email links

Link text, visible domains, redirects, and destination context must agree, while sensitive actions require fresh server-side authorization.

What it is

Email links bridge an untrusted message-rendering environment and a web application. The link itself may carry a short-lived capability or only a route to authentication.

Why it matters

Misleading labels train recipients to ignore phishing signals. Long-lived bearer URLs leak through forwarding, logs, previews, and referrers.

How to implement

Use HTTPS, recognizable first-party domains, honest link labels, short-lived single-purpose tokens, and server-side checks before sensitive changes. Offer a path through the normal site for cautious users.

Common mistakes

  • Showing one domain while linking to another.
  • Putting personal data or permanent credentials in query strings.
  • Completing destructive actions on a GET request.

Verification

Inspect rewritten delivered URLs, follow them while logged out and in the wrong account, reuse expired tokens, and confirm state changes require the intended authorization.

Sources

  1. Digital Identity Guidelines — Authentication and authenticator management — NIST