Pipeline issue

[maralmet]

The pipeline inside inside the created link makes a problem, when the link is sent through outlook 365 and the workstation is connected to network through a VPN. It seems that outlook reads the password and then lets the browser opening it, which leads to an expired password. Is it possible to have the link without pipeline?

[Luzifer]

You can URL-Encode the pipe (|)…

https://ots.fyi/#677c80e5-6ef7-4417-8b47-3fb5d6e67a73|atcdq2485sm
https://ots.fyi/#677c80e5-6ef7-4417-8b47-3fb5d6e67a73%7Catcdq2485sm

I highly doubt Outlook fetches the secret because it does not know how to make the API request. Either the link is just truncated at the pipe so in the example the user would access https://ots.fyi/#677c80e5-6ef7-4417-8b47-3fb5d6e67a73 and by doing this delete the secret themselves or the link has been accessed and confirmed before which then would mean you do have a security issue…

If the link type (the link itself is not valid) I've posted in the example above containing the encoded pipe (%7C) does work with Outlook I can make a change in the frontend code to always display the pipe URL-encoded…

Can you please give it a shot whether Outlook behaves better when using the encoded version of the link? (I don't have access to Outlook / Outlook 365 so I cant test it myself…)