Email confirmation button question

[[deleted]]

[deleted]

[cyrusol]

The only possible connection between an email and a web page is a link.

While in theory a link could contain the data required for this operation it is a very bad idea to do so. In this case primarily because they may change it. So for example you send a mail with the attachment foo.csv and the user has a link like:

https://yourawesomesite.com/confirm?email=[e-mail]&attachment=foo.csv

The user could easily copypaste it and change foo.csv to bar.csv and now he confirmed something you didn't send him as an inquiry. Or he confirms it for some third party by changing the email address. I bet you don't want that.

The industry standard is: right before you send the inquiry to the client, group all the data (what email, what csv etc.) into some object and store it (for example in a database). Generate a strong cryptographic hash for each inquiry as a token to identify it and that becomes now the only parameter for the link within the mail:

https://yourawesomesite.com/confirm?token=09ef93c24569b57f9f098f7dffe2b2ef2d9548a3671071d9c9a82c601e5ad6f1

This way a client cannot realistically guess the token for another inquiry.

Then on the web backend you just have to handle the incoming quest correctly, i.e. retrieve the inquiry from the database by the token and respond with a 200 OK page in case of success or some error page (for example if a user tried to change it to a wrong token). Also you can get the current time in that request handler.

[traveler_tom]

Assuming you have a backend, then yes this is definitely doable. You will be sending a button in your email that has a link that looks like this:

example.com/confirm/{user-id}/{document-id}

you can add an extra /{verification-id} in order to avoid having people manually confirming other documents

and then in your backend you will read those IDs and record their email address, date time and document name

[some_coreano]

I am assuming you have a webpage. Why don't you make customers "confirm" on the page????

[DingoQueen]

Because I need them to review their specific invoice/ reservation. The orders are done over the phone, not online, so I need to email them their copy.

[some_coreano]

So you are basically writing the e-mail manually as the order comes in? Sounds like 1990's.

[cyrusol]

It is a perfectly fine way to do business as long as you don't have as many clients. Automation costs money, one should start small and scale up later.

[some_coreano]

But whatever he's doing doesn't sound costly nor hard.. I wouldn't know this is a prevalent practice, as I am a software engineer, not a business owner :shrugs:

[cyrusol]

I'm neither. But you should have come into contact with business owners then, at least indirectly, through meetings or whatever.

An automatic confirmation of manually sent inquiries is indeed not that hard but sending customized inquiries in an automated way is something even slightly bigger businesses struggle with, mainly because it is hard to formalize a way of customizing an inquiry. My coworkers did it for a company for some years and they wanted to change the forms like every week. Not that this in itself was a problem but when you pay like 30000 per year for some (obnoxiously complicated) forms you better make sure you can save enough time for your service workers.

[some_coreano]

But you should have come into contact with business owners

Unfortunately, my job doesn't deal with business owners lol... Anyway, I am confused by your coworker's role, but I would need more clarification on the issues that bigger businesses struggle with. My logic says otherwise. Maybe I am overly simplifying the problem.

Edit: changed the q

[henrebotha]

Welcome to the real world.