Question: This is not really related on coding per-se, my project is in Laravel 7.1 but more in Outlook's security measurements.

Basically I have a function that sends an email which contains a button, it's a link with a token and a route in my Laravel project to perform something (in this case, the confirmation of an appointment cancellation). When the button is clicked it redirects the user to a page displaying a message saying that the appointment was cancelled successfully or that the token expired (because ofc doing the operation once ends up in removing the token from the database, so trying to do it again will fail and display the message).

This works as intended in testing environments, clicking the same button in Gmail or copying and pasting the link in the browser address bar.

But with Outlook and their masked links with safelink protection, is not working right, once the button is clicked it redirects the user to a expired token message, BUT the operations were performed as they should.
This happens because safelink is visiting the link and checking if it's secure before letting the user open a new tab, issue is that the "fake" visit is making my application to perform the actions as it normally should: (it cancels the appointment based on that token, and it removes the token from database), so by the moment the user is redirected that is counting as a second visit to the link and what the user is getting outputted is the expired token message, which is misleading of course.

This is basically a problem for any one time use links and that's probably affecting other applications out there.

This is a recent change from Microsoft though as this was working a couple months back, safelink is not something new but they introduced that new security feature. It may be happening with other mail providers too, but I just tested with Gmail which is not doing the same and it worked.

So I don't really know what could I do from my part to fix this, is there a way to detect if the click is not coming from a real user or something? are there measurements put in place by Laravel to overcome this?

Thanks in advance.

Answer: 
That behavior's been there for a while. The best you can do is to provide a link to a page where the user would have to explicitly click another link or a button.
I have this issue couple of days already. With trial and error i just found out the solution with my own testing, you just need to set-up the **SMTP** configuration with your outlook account.

Using PHPMailer

I have this configuration before

```
$trans = Swift_SmtpTransport::newInstance()
         ->setHost("xxxxxxxxxxx.mail.protection.outlook.com")
         ->setPort(25);

```

I changed to

```
$trans = Swift_SmtpTransport::newInstance('smtp.office365.com', 587, 'tls')
         ->setUsername('xxxxx@xxxxxxx') 
         ->setPassword('xxxxxxxxxxxx');

```

Now, its working properly. I think **ATP** aka SafeLink Protection Feature will work only if the email address(sender) is not verified within your organization.