Workaround for Outlook previewing login links and expire them prematurely

[frjo]

MS Outlook mail system does a preview of links in all e-mails. This works badly with our login links since they can only be used once for security reasons.

When outlook access the link Hypha expire it and when the user clicks the link it will no longer work.

Having Cloudflare (or another filtering proxy) in front of Hypha can block these attempts. Likely this is the reason OTF has not noticed this issue.

52.167.144.233 - - [07/May/2025:08:57:03 +0000] "GET /this/is/the/link/path HTTP/2.0" 404 527 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; MicrosoftPreview/2.0; +https://aka.ms/MicrosoftPreview) Chrome/100.0.4896.127 Safari/537.36"

I assume other does this previewing as well, Gmail? Yahoo?.

[theskumar]

Options:

1. Block request from crawler based on header . https://pypi.org/project/crawlerdetect/
2. Use OTP Codes instead of links.

[killapop]

Hi,

is there a quick workaround for this that one can use? A Hypha installation is used by many folks who have Microsoft corporate accounts and they have massive problems with this. I was to disable the passwordless login from the front end but some other links like resetting passwords etc also use the one time link and are invalidated.

Any short time advice on how to address this will be much appreciated.

🙏 many thanks

[frjo]

Do you use Cloudflare? OTF has that in front and some setting there fixes this issue it seems.

[killapop]

@frjo sorry for the long silence.
No we don't use Cloudflare so any advice will be highly appreciated :). As mentioned a lot of folks applying use outlook 365 emails and its quite an inconvenience to follow up with them.

If I get an indication from your team on the general direction from the suggestions of @theskumar above, I can try and implement it on our fork and create a PR. I just don't want to have to do any else than core hypha :)

thanks 🙏

[frjo]

If you have access to your web server it should be quite straight forward to block any access attempts where the http_user_agent contains "MicrosoftPreview".

Time permit we could build this in to Hypha as a django middelware. This middleware would optionally block all calls to /auth and /login paths where http_user_agent contain the string "MicrosoftPreview".