Detect when request is for preview generation

Question

We have certain action links which are one time use only. Some of them do not require any action from a user other than viewing it. And here comes the problem, when you share it in say Viber, Slack or anything else that generates a preview of the link (or unfurls the link as Slack calls it) it gets counted as used since it was requested. Is there a reliable way to detect these preview generating requests solely via PHP? And if it's possible, how does one do that?

Answer 1

Not possible with 100% accuracy in PHP alone, as it deals with HTTP requests, which are quite abstracted from the client. Strictly speaking you cannot even guarantee that user have actually seen the response, even tho it was legitimately requested by the user.

The options you have:

• use checkboxes like "I've read this" (violates no-action requirement)
• use javascript to send "I've read this" request without user interaction (violates PHP alone requirement)
• rely on cookies: redirect user with set-cookie header, then redirect back to show content and mark the url as consumed (still not 100% guaranteed, and may result with infinite redirects for bots who follow 302 redirects, and do not persist cookies)
• rely on request headers (could work if you had a finite list of supported bots, and all of them provide a signature)