1

I have a web application which sends a download link to subscribers. Subscribers are able to click the link from their inbox and get access to download a pdf document. It is fine but what I want is to allow the access to pdf document only when link is clicked from his inbox only. I mean if subscriber forwards this email to some one else or tries to paste the link in browser manually it should not work.

E_net4
  • 27,810
  • 13
  • 101
  • 139
Rahmat Ali
  • 71
  • 1
  • 2
  • 4

4 Answers4

3

What you want is impossible.

Consider this situation: You email someone@example.com. They can view the email via:

a) Desktop mail client
b) Smartphone/tablet mail client
c) Webmail

All three will appear "different" to your server, depending on exactly which client they clicked on your link in. And if the user forwards the email to someone else, say otherperson@example.com, the EXACT same link will be in that person's mail file as well, and they can view it via the exact same options.

You MIGHT be able to extract a username or some other personally identifiable datum from the refer IF they used webmail and the webmail system is stupid enough to have webmail.example.com/readmail?userid=someone

But otherwise, no, you cannot assume anything about the incoming click, only that SOMEONE clicked on the link in SOME email.

Marc B
  • 356,200
  • 43
  • 426
  • 500
  • *All three will appear "different" to your server* — It is more likely that they will all appear the same (both as each other and as anyone the link was forward to). – Quentin Aug 25 '14 at 18:21
  • *and the webmail system is stupid enough* — and to not be using SSL (since browsers will block outgoing referers from it) – Quentin Aug 25 '14 at 18:22
  • *that SOMEONE clicked on the link in SOME email* — You can't even tell that. All you can tell if that there is no referer header in the request. – Quentin Aug 25 '14 at 18:22
  • @Fred-ii-: what good would that do? I get the email, I forward it to someone else without ever clicking on it, that person clicks, and they're in. – Marc B Aug 25 '14 at 18:30
  • True, true. *But*, that'll teach the person who forwarded the email in the first place, and won't be able to do it him/herself after; *shoots him/herself in the foot* for it. ;) – Funk Forty Niner Aug 25 '14 at 18:31
  • Thanks for your reply. Actually I am thinking, may be I am wrong please correct me if so, is there no way to get any type of information related to particular email address or inbox etc back at the time email is sent to subscriber's inbox? If it is possible then I can save this information in database for recognizing the request from same inbox any time. May be I am thinking in wrong direction but I am not sure. Thanks. – Rahmat Ali Aug 25 '14 at 18:33
1

There is no way to tell if a link was opened from an email client or if it was pasted into the address bar. There is no way to track if an email has been forwarded (webbug images in an HTML formatted email are blocked by most email clients).

If you want to limit who can download the file from your servers, then require that users login and then hope that none of them engage is password sharing.

Even that won't stop them redistributing the file directly.

Quentin
  • 914,110
  • 126
  • 1,211
  • 1,335
  • Thanks for your reply Quentin! Actually I am thinking, may be I am wrong please correct me if so, is there no way to get any type of information related to particular email address or inbox etc back at the time email is sent to subscriber's inbox? If it is possible then I can save this information in database for recognizing the request from same inbox any time. May be I am thinking in wrong direction but I am not sure. Thanks. – Rahmat Ali Aug 26 '14 at 11:15
  • You can send a unique link to each user. That won't tell you the address of the person clicking on the link, only of the address you send it to in the first place. – Quentin Aug 26 '14 at 12:01
1

Its not really possible to "protect" a link.

But if your web application require user to login, you can generate a unique link for each of your user, and require him to login before allowing download.

People will be less prone to share their login/password than a simple url.

Fenring
  • 31
  • 4
  • Thanks for your reply Fenring! Actually I am thinking, may be I am wrong please correct me if so, is there no way to get any type of information related to particular email address or inbox etc back at the time email is sent to subscriber's inbox? If it is possible then I can save this information in database for recognizing the request from same inbox any time. May be I am thinking in wrong direction but I am not sure. Thanks. – Rahmat Ali Aug 26 '14 at 11:16
0

I know this is an old question and I'm not sure why it was down-voted, but an idea occurred to me. If you put a common pixel tracker in your email with a token that identified the user and the email edition which, when requested, your server would note the time the email was opened and read (and successive reads). Then if the user clicks the link in the email, a token on the link identifies the same user and email edition. When the server receives this request it could compare it to the last time the matching tracking pixel was accessed. If the pixel was accessed within a few minutes before the link was requested, that implies that the email was opened and then the link was clicked.

If the user book marks the link and uses it the next day, there would be no recent tracking pixel history, which implies that the request was not from the inbox.

This would be easy to spoof, so it shouldn't be used for any kind of security concern. You wouldn't know if the email was forwarded to another person. Their email client would hit the tracking pixel as well.

Many email clients would block the pixel tracking for ever-increasing privacy concerns, so it isn't reliable.

If you're just looking for an indication of usage, this might work.

changokun
  • 1,563
  • 3
  • 20
  • 27