It recently happened that a customer received the message "he already is unsubscribed" even he only clicked the unsubscribe link in the mail once.
Digging through logs i have seen that a HEAD request to the exact same unsubscribe Url is made prior to the regular GET request (Maybe caused by a Mail Client).
The UnsubscribeAction processes this HEAD request and does its job, unintentional i would assume.
Because this behaviour caused some confusion, i xclassed the FrontendController adding an initializeUnsubscribeAction to only handle GET requests, according to this example https://docs.typo3.org/m/typo3/reference-coreapi/main/en-us/ExtensionArchitecture/HowTo/BackendModule/SecurityConsiderations.html#backend-modules-security
use TYPO3\CMS\Core\Http\AllowedMethodsTrait;
class LuxletterFrontendController extends \In2code\Luxletter\Controller\FrontendController
{
use AllowedMethodsTrait;
/**
* enforce get method for unsubscribe
*
* @return void
*/
public function initializeUnsubscribeAction(): void
{
$this->assertAllowedHttpMethod($this->request, 'GET');
}
}
It recently happened that a customer received the message "he already is unsubscribed" even he only clicked the unsubscribe link in the mail once.
Digging through logs i have seen that a HEAD request to the exact same unsubscribe Url is made prior to the regular GET request (Maybe caused by a Mail Client).
The UnsubscribeAction processes this HEAD request and does its job, unintentional i would assume.
Because this behaviour caused some confusion, i xclassed the FrontendController adding an initializeUnsubscribeAction to only handle GET requests, according to this example https://docs.typo3.org/m/typo3/reference-coreapi/main/en-us/ExtensionArchitecture/HowTo/BackendModule/SecurityConsiderations.html#backend-modules-security