HMAC-signed links handle one-click unsubscribe in a 1,258-line self-hosted newsletter server

The confirm link is the part of this build I would copy. Its token is the subscriber's address and an action, joined and base64url-encoded, followed by an HMAC-SHA256 of that payload ^[7]. Verification recomputes the MAC and compares the two with `timingSafeEqual` ^[7]. There is no token table and no expiry to manage, so a confirm link still works while the database is mid-restart ^[7]. "A confirm link that still works when the database is asleep is one less thing that can rot," the author wrote ^[1].

Unsubscribe tokens never expire, on purpose ^[8]. Revoking them means rotating the signing key, which lives outside the repository and is mounted read-only at runtime ^[8]. I think that is the right tradeoff for one list and one sender. The author's reason is that consent mechanics must keep working forever, and with no token table there is no stored state for a link to disagree with ^[8][7].

The standard also cost one security check. Gmail sends its one-click unsubscribe as a cross-origin POST from its own servers, and the route's same-origin CSRF check blocked it ^[9]. The author disabled that check on the route and left authentication to the MAC, which the post calls unforgeable ^[9].

The subscribe endpoint is defended before it reads an address. It first checks a hidden form field named `website`. Humans leave it empty, and a bot that fills it gets a fake ok and nothing else ^[5]. Behind that sits a token bucket of 10 requests per hour per IP and one resend per address every 10 minutes ^[6]. Responses are identical whether or not an address is already subscribed, so the endpoint cannot be used to learn who is on the list ^[6].

The first failure in the author's ledger had nothing to do with email. The command `pnpm install --frozen-lockfile` ran clean locally and died in the container on `ERR_PNPM_IGNORED_BUILDS`, because esbuild's postinstall script was never approved ^[10]. Shipping a small `pnpm-workspace.yaml` that declares allowed build scripts fixed it, after half a day of searching ^[10].

The 1,258 lines are a measurement of one workload. The author describes a small list, one email per post, and a site whose other services they already run ^[14]. The build has one list, no segments, no open tracking, and no scheduling beyond a CLI run by hand or on a timer ^[12]. The core took an afternoon and the edges another ^[13]. The post does not break the count down by language, and it includes Svelte alongside TypeScript and SQL ^[1]. "The hard part of email marketing became a standardized header," the author wrote ^[3]. On delivery, the author says the fix for the missing DKIM alignment "is known and waiting if the list ever justifies it" ^[11].