Skip to main content

Magic Link login fails for Hotmail/Outlook users (link pre-fetched by Microsoft Safe Links)

Hi Fluent Auth team,

We're running Fluent Auth with Magic Link login enabled as part of the full Fluent stack (FluentCRM, Fluent Community, Fluent Cart, Fluent Forms, Fluent SMTP, Fluent Snippets) and are seeing a consistent issue for users with Hotmail / Outlook.com / Live.com addresses.

What happens:

  1. The user requests a magic link and receives the email correctly.
  2. When they click the link, they land on the site but are NOT logged in (the link is treated as invalid/expired).
  3. Users on Gmail and other providers log in without any problem.

Cause (as far as we can tell):
Microsoft's link scanning (Outlook.com / Defender Safe Links) pre-fetches every URL in incoming emails to check for phishing. That GET request hits the magic link endpoint before the user clicks, so the one-time token is consumed by the scanner. By the time the real user clicks, the token has already been used.

Questions:

  • Is there a setting in Fluent Auth to require an explicit confirmation step (e.g. a "Log in" button on an intermediate page, so the token is only consumed on a POST/click rather than on the initial GET)?
  • If not, is there a hook/filter we can use to intercept the magic link request before the token is validated, so we can add such a confirmation page ourselves?
  • Alternatively, is there a way to allow a short grace window or a limited number of uses for a token?

This is a known pattern with Microsoft mail scanning and affects any one-time login link, so a built-in confirmation step (or an option to put the token in the URL fragment) would be a very welcome addition. Since Fluent Community members rely on this login flow, it's currently blocking a noticeable share of our users.

Environment:

  • WordPress (latest), hosted on Hostinger behind Cloudflare
  • Fluent Auth, FluentCRM, Fluent Community, Fluent Cart: all on the latest versions
  • Email sent via Fluent SMTP

Happy to provide logs or test accounts if helpful.

Thanks,
David

On it!

David Carton

Shahjahan JewelΒ Thanks πŸ™

David CartonΒ released a new version with a fix.

David Carton

Shahjahan JewelΒ Thank you! Wish you good weekend. Wil take a look at it ;)