Magic links and password reset tokens consumed by email scanners in institutional environments

[DylanLawless]

Magic links and password reset links are frequently consumed by automated email scanners in enterprise, university, and hospital environments. When this happens, Supabase tokens are invalid by the time a user clicks the link. I see discussions where this seems to be misattributed to browsers or email clients, but the root cause for me is usually mail infrastructure prefetching the URL.

A simple pattern that worked reliably for us was to avoid placing {{ .ConfirmationURL }} directly in the email. Instead, we wrap it inside the URL fragment of an intermediate landing page, for example:

/auth/reset_password/start#confirm={{ .ConfirmationURL }}

Because URL fragments are not fetched by scanners, the token is only verified after an explicit user click. The landing page extracts the confirmation URL from the fragment and redirects on user action, typically via a single “Continue” or “Reset password” button.

This requires a small client-side handoff page, so it may not be something to enforce via templates. However, it seems to be a common institutional hurdle, and documenting this pattern as a recommended option could help users who currently suspect browser or email client issues.

Here is a mini pseudo-code demo for the handoff page. I can give more clear info if desired.

read fragment from URL
if fragment missing
  show error
else
  extract confirmation URL from fragment
  wait for explicit user click
  redirect browser to confirmation URL

Best wishes,
Dylan

[matthewtmoran]

@DylanLawless I'm running into the same issue so this post is helpful.

1. I'm curious if you did something similar for confirming emails?
2. I want to make sure I understand the complete flow your using for password reset.

• reset password email has link to `auth/reset_password/start#confirm={{ .ConfirmationURL }}
• user lands on auth/reset_password/start
• this page extracts ConfirmationURL
• user must click an additional button on this page that redirects them to the ConfirmationURL
• the ConfirmationURL page has the input for reseting password.

I'm curious if you've tried automatically redirecting after extracting the fragment?