Emails without a template have no unsubscribe link or List-Unsubscribe header #21

New issue

Closed

opened 2026-10-14 23:33:52 -04:00 by vmanne-poc · 0 comments

vmanne-poc commented

2026-10-14 23:33:52 -04:00

Owner

Found while smoke-testing the Phase 8 upgrade.

Problems

A campaign sent without a template contains no unsubscribe link. The link only appears if the template or body includes {{ unsubscribe_url }}. Recipients then have no way to opt out, which commercial-email rules (e.g. CAN-SPAM) require.
No List-Unsubscribe / List-Unsubscribe-Post headers, so mail clients can't offer their built-in unsubscribe button, and Gmail/Yahoo bulk-sender rules expect one-click unsubscribe.
The unsubscribe link is rewritten through the click tracker, so unsubscribing counts as a click and inflates the click rate.
Unsubscribe happens on a plain GET, so link scanners that prefetch URLs can unsubscribe people without them clicking.

Fix

Append an unsubscribe footer when the email doesn't already contain the link.
Send List-Unsubscribe + List-Unsubscribe-Post: List-Unsubscribe=One-Click (RFC 8058).
Don't route Postak's own links through the click tracker.
GET shows a confirmation page; POST unsubscribes (also used by one-click).

Found while smoke-testing the Phase 8 upgrade. **Problems** 1. A campaign sent without a template contains **no unsubscribe link**. The link only appears if the template or body includes `{{ unsubscribe_url }}`. Recipients then have no way to opt out, which commercial-email rules (e.g. CAN-SPAM) require. 2. No `List-Unsubscribe` / `List-Unsubscribe-Post` headers, so mail clients can't offer their built-in unsubscribe button, and Gmail/Yahoo bulk-sender rules expect one-click unsubscribe. 3. The unsubscribe link is rewritten through the click tracker, so unsubscribing counts as a **click** and inflates the click rate. 4. Unsubscribe happens on a plain `GET`, so link scanners that prefetch URLs can unsubscribe people without them clicking. **Fix** - Append an unsubscribe footer when the email doesn't already contain the link. - Send `List-Unsubscribe` + `List-Unsubscribe-Post: List-Unsubscribe=One-Click` (RFC 8058). - Don't route Postak's own links through the click tracker. - `GET` shows a confirmation page; `POST` unsubscribes (also used by one-click).

vmanne-poc added this to the Phase 8: Dependency security & user management (v0.8.0) milestone

2026-10-14 23:33:52 -04:00

vmanne-poc added the

bug

security

labels

2026-10-14 23:33:52 -04:00

vmanne-poc referenced this issue from a commit

2026-10-14 23:48:21 -04:00

Fix unsubscribe compliance: footer link, List-Unsubscribe headers, POST-only unsubscribe

vmanne-poc referenced this issue from a pull request that will close it,

2026-10-14 23:48:49 -04:00