Chime.Unsubscribe (Chime v0.1.0-dev)

Copy Markdown View Source

The links to unsubscribe of the emails, mounted with Chime.Router.chime_mail/2 at the config's :mail_url:

pipeline :mail do
  plug :accepts, ["html"]
end

scope "/" do
  pipe_through :mail
  chime_mail "/notifications/mail", app_name: "Atelier"
end

An email of a notification has a link to turn off its category's emails (and the headers of one-click unsubscribe, RFC 8058); a digest has a link to turn off every email that is not required.

  • GET /:token - a page that asks to confirm, with a button: a mail client or a scanner that opens links must not unsubscribe anyone.
  • POST /:token - unsubscribes, and says so. A mail client's one-click (List-Unsubscribe=One-Click as the body) is this too, with no session and no CSRF token: mount it behind a pipeline without protect_from_forgery. The token is signed, and says who and what: it is the request's only credential.

An unknown or forged token is a 404. The person can turn the emails on again in the app's preferences.