Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Email addresses inside URL

Is it safe to use e-mail addresses inside URLs? I mean lets say a web-application has a registered user "Bob" and Bob has been registered by using his email => [email protected]. Now what's your opinion, is it safe for the application to accept and work with GET requests on //application.com/[email protected] and the same kind of URLs for every user?

like image 620
Kostas Avatar asked Dec 05 '13 12:12

Kostas


People also ask

Is it OK to pass email address in URL?

No it is not possible with PHP or Javascript to just grab the email address. You could pass the email address/unique identifier in URL but this would need to be inside the URL you sent to the users mailbox.

Can an email address be a URL?

A mailto link is a Uniform Resource Identifier (URI) scheme for email addresses. It is a type of HTML or URL link that activates the default mail client (Gmail, Outlook etc.) on the computer for sending an e-mail.

How do I hide email address in URL?

If you're including the email in the URL you cannot hide it, but you can encrypt it. If encryption doesn't rock your world, and you simply want to obscure the email address, you could obfuscate it. The application sends an email with a link to a landing page to a prospect from an inquiry.


1 Answers

Basically it depends on if you love or hate your users. When you do what you suggest, these URLs will spread on HTML pages on the web. Not necessarily confined to your own site, because people may link to it.

When your page gains enough traction to become important, crawler authors for spam bots will notice and add rules to their crawlers to extract the email address from URLs. It might even not be necessary, because some dumb regexes might already find the email without adaption.

Then, your users' email addresses will land on spammers' lists and get "unwanted adverts", euphemistically speaking. (These email lists will be rather high-valued, too, because they are "verified" to be real, existing ones.)

What you're doing here is giving away a private bit of identification your users trusted you with. Never ever allow that to be in public, unless your users told you so!

From a technical perspective, you can just go for it.

like image 50
Boldewyn Avatar answered Oct 17 '22 22:10

Boldewyn