I unsubscribed from one of the StackOverflow emails (The Overflow), which took me to the Email Settings page with a green "Unsubscribed" notice in that entry. There's no indication on the page that it is any different from the page reachable from the user profile, but any attempt to change any other settings has no effect. Even after reloading the page it remains non-functional, and attempting to load a "fresh" copy by clicking "Edit Email Settings" in the left sidebar results in
Navigating to the same "Email Settings" page via my user profile results in a functional version of the same page (changes take effect).
I believe if the Email Settings page is used to confirm the unsubscribe, then it should be functional. The simplest use case for this is if a user mistakenly clicks on an unsubscribe link. They should be able to undo that by clicking on the appropriate button on that page, which presently they can't.
After reading ShadowKeepsSocialDistance's answer and thinking about it I remembered that the non-functional Email Settings page that displayed the "Unsubscribe Successful" message did actually show me as logged in. So I did some more testing and found that
- Going back to the "The Overflow" email and clicking the link "Unsubscribe from emails like this" takes me once again to the non-functional settings page; and, more importantly
- There's an "Edit email settings" link at the bottom of the email that takes me to a FUNCTIONAL settings page.
So I conclude that this is a real bug, and not an artifact of how the unsubscribe opaque token works.
Here are the two [redacted] URLs. I've inserted spaces to line up the query strings to highlight the differences. Redaction is indicated by
[...] and in both cases the exact same content was redacted in each link.
The first is the non-functional settings page reached from the
Unsubscribe link at the bottom of the email, while the second is the functional page reached from the
Edit email settings link
Unsubscribe: https://stackoverflow.com/users/email/settings/unsubscribe/1024?iterable=1&id=9[...]0&auth=5ed6e72[...]d8d &email=[...]&campaignId=1170965&templateId=1636485 Edit Settings: https://stackoverflow.com/users/email/settings/ ?iterable=1&id=9[...]0&auth=5ed6e72[...]d8d&bucketId=1024&messageId=7fd61b[...]775&email=[...]&campaignId=1170965&templateId=1636485
And finally, the URL of the "Invalid Request" page is identical to the
Edit Settings link above with the single exception that the
@ in the email query string is URL-encoded as
%40 instead of appearing as itself.