Email Settings page non-functional when reached via unsubscribe link

Question

I unsubscribed from one of the StackOverflow emails (The Overflow), which took me to the Email Settings page with a green "Unsubscribed" notice in that entry. There's no indication on the page that it is any different from the page reachable from the user profile, but any attempt to change any other settings has no effect. Even after reloading the page it remains non-functional, and attempting to load a "fresh" copy by clicking "Edit Email Settings" in the left sidebar results in

Navigating to the same "Email Settings" page via my user profile results in a functional version of the same page (changes take effect).

I believe if the Email Settings page is used to confirm the unsubscribe, then it should be functional. The simplest use case for this is if a user mistakenly clicks on an unsubscribe link. They should be able to undo that by clicking on the appropriate button on that page, which presently they can't.

Additional Info:

After reading ShadowKeepsSocialDistance's answer and thinking about it I remembered that the non-functional Email Settings page that displayed the "Unsubscribe Successful" message did actually show me as logged in. So I did some more testing and found that

1. Going back to the "The Overflow" email and clicking the link "Unsubscribe from emails like this" takes me once again to the non-functional settings page; and, more importantly
2. There's an "Edit email settings" link at the bottom of the email that takes me to a FUNCTIONAL settings page.

So I conclude that this is a real bug, and not an artifact of how the unsubscribe opaque token works.

Here are the two [redacted] URLs. I've inserted spaces to line up the query strings to highlight the differences. Redaction is indicated by [...] and in both cases the exact same content was redacted in each link.

The first is the non-functional settings page reached from the Unsubscribe link at the bottom of the email, while the second is the functional page reached from the Edit email settings link

Unsubscribe:   https://stackoverflow.com/users/email/settings/unsubscribe/1024?iterable=1&id=9[...]0&auth=5ed6e72[...]d8d                                       &email=[...]&campaignId=1170965&templateId=1636485
Edit Settings: https://stackoverflow.com/users/email/settings/                ?iterable=1&id=9[...]0&auth=5ed6e72[...]d8d&bucketId=1024&messageId=7fd61b[...]775&email=[...]&campaignId=1170965&templateId=1636485

And finally, the URL of the "Invalid Request" page is identical to the Edit Settings link above with the single exception that the @ in the email query string is URL-encoded as %40 instead of appearing as itself.

Answer 1

From what I see, it's because you're not really logged in while following a link, it's rather something I call "token action" personally, not sure if it's official term. The reason is that you make an action that usually requires logging in via pure GET request, so must use some unique and unguessable token to prevent hacking.

Hence, it's not possible to perform any other action since it's not really your account, just a single action.

I agree the UI can be improved e.g. just a message "you unsubscribed successfully", but that's not a bug as far as I can tell.