Skip to content

URL access token enforcement for email links

  • Introduced in: OpenAEV 2.260622.0

Description of changes

Starting with OpenAEV 2.260622.0, OpenAEV no longer accepts legacy email URLs that rely on userId and user query parameters for player access flows.

OpenAEV now requires a short-lived URL access token through:

/url/access?token=<raw-token>

After the first successful access, OpenAEV sets a secure cookie and redirects the user to the target resource URL.

Impact

Legacy links generated before this change are not compatible with OpenAEV 2.260622.0.

Typical effects of enhanced security include:

  • 401 Unauthorized when opening old email links
  • Access failures on player routes that previously relied on legacy query parameters

Migration guide

  1. Upgrade OpenAEV to a version that supports URL access token links.
  2. Regenerate and resend player emails (Media Pressure, Challenge, and Lessons Learned) so users receive token-based links.

Warning

Do not keep old links in operational runbooks. Ask users to open newly generated emails after upgrade.

Validation checklist after upgrade

  1. Send a new player email and confirm the URL format is /url/access?token=....
  2. Open the link and verify the redirect succeeds.
  3. Confirm the platform sets a secure cookie (HttpOnly, Secure, SameSite=Strict).