Outlook Web Access (OWA) previews expire one-time links about django-sesame HOT 4 CLOSED

:-(

Perhaps it would be best to blacklist the OWA preview User-Agent i.e. reject the login and not expire the token.

I'm wary of accepting the login and not expiring the token. I think this could open a hole in the security model.

from django-sesame.

A quick Google search doesn't turn up the User-Agent that Office 365 uses. But this is reasonably easy to determine through testing.

from django-sesame.

Apparently email link scanning by, e.g., spam filters, is pretty common:

https://security.stackexchange.com/questions/66090/are-there-secure-alternatives-to-single-use-password-reset-links

It might be worth noting this in the docs.

from django-sesame.

When I send an email containing a link to a website that I control to my corporate Outlook mailbox, I see requests from IP addresses belonging to Microsoft before I even receive the email.

The crawler masquerades as Chrome on Windows 10.

Since it's for security purposes, it has to be indistinguishable from a regular user. Else, an attacker could send innocuous content to the crawler and nefarious content to regular users.

So I'm just going to document the pitfall.

Thanks for reporting this issue, and sorry I can't do better.

from django-sesame.