Search code examples
next.jsoutlooknext-authheadsafelinks

Magic Link blocked by Outlook SafeLink policy


I've created a login system with NextAuth where I send a magic link so the user can login through it. When I try to login with Gmail everything is ok. The problem shows up when I try to use Outlook. Because of the safe link policy, outlook blocks the link that I send and I got the message: "The sign in link is no longer valid. It may have been used already or it may have expired."

I've read from people complaining about this and the solution seemed to be blocking an HEAD request made by a bot to check if the link is legit. I tried that solution but the problem persists. I'm stuck with this problem for a long long time. I'd appreciate some help.


Solution

  • The only solution is to point that link to a web page that requires the user to click a button. If you have a link in an email, be prepared that something will crawl it. Your code should not assume that only the user can access your link.