https://brtkwr.com/tags/transactions/Recent content in Transactions on brtkwr.comHugoenFri, 17 Jul 2026 12:00:00 +0000https://brtkwr.com/posts/2026-07-17-the-404-that-mail-providers-caused/Fri, 17 Jul 2026 12:00:00 +0000https://brtkwr.com/posts/2026-07-17-the-404-that-mail-providers-caused/<h2 id="tldr"> TL;DR <a class="heading-link" href="#tldr"> <i class="fa-solid fa-link" aria-hidden="true" title="Link to heading"></i> <span class="sr-only">Link to heading</span> </a> </h2> <p>Put a long signed token in an email link and you have built a bug that fires deterministically for some recipients and never for others. MIME quoted-printable wraps lines at column 76, some mail providers re-encode the message and mangle the escape that lands on the wrap seam, and if the first seam falls inside the token a single flipped character makes the signature stop matching. The page returns 404. The fix is to keep the URL credential short, an opaque id resolved server-side. But that swap turns a stateless credential into a stateful one, and there is a whole family of transaction-ordering traps waiting on the other side. Those traps are the more interesting part.</p>