Outbound Email - Link Expiration

Question

We are using SDL Tridion 2011 SP1 with Java on the presentation side. We have a requirement where we need to expire the Subscription links generated by OE after a given time interval or after first use (by use I mean an actual Profile Update or Change Password). To do this we are maintaining a separate DB table at the presentation side and whenever someone requests a "Forgot Password" email from the website we create an entry in this table. The table has 3 fields as:

1. Email Adress
2. Active
3. Date/Time of link generation

Whenever a user clicks on the link from the email, we get the email address from the parameter (automatically added by OE) and lookup the record from the DB. If the record returns active and date/time is within the link expiration period, we allow the user to update their password, else show them a "Link Expired" message.

Now we have identified two problems with this approach.

1. This works only if the email originating due to some user action on the presentation side. This is because then only the record is inserted in the DB
2. If a second "Forgot Password" email is requested by the same user, all links generated for this user in the past are activated as the only identification is email address. There is no unique identification for each link generated

In short the following is happening:

1. I requested a forgot password
2. I received an email, let’s call it (email 1)
3. I clicked on the link in the email and everything was fine, however, I did not perform any action. So the link is still valid
4. After some time, the link from (email 1) expired, as it should
5. I requested a forgot password again
6. I received an email (email 2)
7. Now the links in (email 1) and in (email 2) are both working, meaning that the link in (email 1) was re-activated, which shouldn’t be happening

Is it possible to add a custom dynamic parameter to the Subscription Management links generated by OE at the time of generating the emails? Is there any other parameter embedded in the encrypted "p" parameter generated by OE that can be used to address this situation?

Answer 1

I guess you could add a SUBSCRIPTION_MESSAGE_ID field (INT) to the extended details of the contact and increment this every time a subscription message is to be sent. You could then add this as another parameter to the links in your subscription message template as a merge field, and check this against the current value when they click through.

<a href="@@OutboundEmail_ConfirmURL@@&amp;smid=[* SUBSCRIPTION_MESSAGE_ID *]">Click here to reset your password</a>