Skip to main content
Parul_Arora
Parul_Arora
Level 1
December 5, 2019
Question

Unsubscribe link doesn't function correctly

  • December 5, 2019
  • 1 reply
  • 1277 views

In a promotional email, Unsubscribe link is not associated to person's ID. This is a generic link( see below)

Therefore I can unsubscribe anyone(by giving any other person's ID) also from same unsubscribe link. 

na-ab39.marketo.com/lp/hclamerica/UnsubscribePage.html?mkt_unsubscribe=1 

It is not a correct use case per me,  Is there a way to deal with this? or can we pass a unique identifier in unsubscribe link so that it can't be reused for another ID. Thanks!

This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.

1 reply

SanfordWhiteman
SanfordWhiteman
Level 10
December 5, 2019

As you acknowledge, you're coming up with an idea of "correct" behavior that doesn't come from how Marketo works (and has always worked).

The link is just a link to an LP (which happens to be your UnsubscribePage.html, but it's otherwise the same as any LP once they get there).

If the LP has a form on it, and the form exposes the email as an editable textbox, then yes, anyone can easily see that they can enter another address.  If you want to reduce the temptation to enter another address if the person is relatively innocent/unskilled, then remove the form field and just have the button. However, this won't stop them from deliberately and maliciously submitting the form on behalf of another person.

If you want to move beyond the default level of security, you need to institute either

   (a) a confirmation link sent to form submitter, and only after they click another button (note: not just click the email link, that will not work)

   or

   (b) a self-service "confirmation code," most likely the Marketo Unique Code that everybody already has, and they need to enter that code alongside the email address in order for the value to be changed

Terms & ConditionsAccessibility statement

Loading footer...