Email unsubscribe handling security

This is a good example for a case where usability and security do not go hand in hand.

A user wants usability: They want to be able to click the link and be unsubscribed. They want this to always work (not just X amount of time after receiving the email, and definitely not with X being 15 minutes or an hour).

You want security: You don't want an attacker do be able to force-unsubsribe your users.

Now lets analyze these needs:

Usability

The usability one is rather important. If you do not allow easy unsubscribe:

• your brand will suffer an image damage
• your emails will be treated as spam
• you are in violation of the CAN-SPAM Act (see eg here: The law also requires that the unsubscribe mechanism must be able to process opt-out requests for at least 30 days after the transmission of the original message)

Security

So you are using a securely generated, long, random token, meaning that an attacker cannot just brute-force your unsubscribe form to unsubscribe a large portion of your users.

At most, an attacker can unsubscribe single users after they somehow revealed their unsubscribe token.

So what's really to worry about? No attacker will use social engineering to get the unsubscribe token of users. They will also not hack into the email of your users or your database just to unsubscribe them from your newsletter.

So the only likely attack scenario is: A user accidentally posts your newsletter including their unsubscribe token to a website. Someone sees this and decides to unsubscribe that user.

This may cause a small annoyance to you and possibly the user, but it is a scenario which is unlikely to happen often.

Conclusion

A correctly generated random token is enough for an unsubscribe link.

The dangers of this token being revealed are low, and using any other mechanisms (such as requiring logins or expiring the token after a short time) are generally not acceptable.

At most, you could expire a token after 30 days. But that also means that you need to have more than one token per user.