Documentation
¶
Overview ¶
Package unsubhttp serves the no-login unsubscribe endpoint linked from every notification email footer and named by the RFC 8058 List-Unsubscribe header.
It also mints and verifies the HMAC token that link carries, so the one place that decides a token is valid is the one place that acts on it. The opt-out it records is an ordinary preference write: delivery mode "off" for the address the token names.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func UnsubToken ¶
UnsubToken returns the opaque token an email footer's unsubscribe link carries for recipient. The token binds the address with an HMAC so only a holder of the emailed link can opt that address out; it deliberately never expires, since a stale footer link that stops working strands exactly the recipient the link exists for. It grants nothing but the opt-out: prefs are keyed by bare email, so it works identically for account holders and recipients with no account (#1001).
Types ¶
type UnsubscribeHandler ¶
type UnsubscribeHandler struct {
Prefs notification.PrefsStore
// Key signs and verifies the footer tokens; see UnsubToken.
Key []byte
// BrandName heads the confirmation page.
BrandName string
}
UnsubscribeHandler serves GET and POST on /portal/notifications/unsubscribe?tok=..., the no-login opt-out linked from every notification email footer and named by the List-Unsubscribe header. A valid token writes delivery mode "off" for the address it names; the share and comment enqueue paths already honor that mode, so the recipient receives no further notification emails. One-time view links are unaffected: those are transactional sends the recipient asks for, not notifications.
func (*UnsubscribeHandler) ServeHTTP ¶
func (h *UnsubscribeHandler) ServeHTTP(w http.ResponseWriter, r *http.Request)
ServeHTTP routes the endpoint's three cases. GET renders a confirmation page and performs no mutation: corporate mail security layers (Safe Links, Proofpoint, and similar) prefetch URLs in message bodies, and the token is a bearer credential, so a mutating GET would let a recipient's own mail infrastructure silently opt them out (#1022). The opt-out records only on POST: either the RFC 8058 one-click body a mail provider sends on a real user action in its own UI, or the confirmation page's form submit.
Source Files