Issue Summary

We observed an issue where email security scanners, used by some customers, automatically click on links in emails to detect potential threats.

As a result, unsubscribe links present in request notification emails are being triggered without any human interaction, causing users to unintentionally unsubscribe from important notifications.

To mitigate this, we propose introducing friction in the unsubscribe flow. This could include one or more of the following measures:

• Adding a confirmation page before completing the unsubscribe action.
• Using CAPTCHA or similar verification to ensure human interaction.
• Including an explicit "Confirm Unsubscribe" button after the initial link click.

The goal is to ensure that unsubscribe actions are intentional and only performed by actual users, thereby preserving the user’s notification preferences and preventing accidental loss of important communication.

Steps to Reproduce

1. Create an organization in a JSM (Jira Service Management) project.
2. Make sure the project using the default customer notification template with the link to turn off the notification.
3. As a customer, create a ticket via portal and share it with an organization.
4. Ask an agent to add a public comment.
5. Wait till customer notification triggered to the customer (reporter).
6. Log into the portal as the customer who raised the ticket
7. Open the request

Expected Results

The customer should be subscribed to receive notifications from the support request. The option Don't notify me should be visible, which means that the customer is subscribed and has the option to unsubscribe from the UI:

Actual Results

The customer is no longer subscribed even though they did not opt out themselves from receiving notifications from the support request. The option Get notifications is shown, which means that the customer is no longer subscribed and needs to manually opt back in:

Workaround

The workaround is to remove the link from customer notification template in each JSM project, via the page Project Settings > Customer Notifications > Edit Templates

• For HTML , remove this section :-

  <span class="jsm-link-separator">&middot;</span>
      <a class="jsm-unsubscribe-link" href="${request.disable.notifications.url}">Turn off this request's notifications</a> 

• For "Plain Text" , to remove for customer receiving with plain text template and remove this section:

  Turn off this request's notifications: ${request.disable.notifications.url}
  

In some cases you'd have to remove this link from both HTML and "Plain text" configurations.
Ensure that the unsubscribe link is also removed from the template in translations if translations are enabled.