Passwordless login - links invalidated on security checks

[MaticSulc]

Bug report

Summary

While using passwordless login in MODX 3, it seems like security checks from e.g. Office365 invalidate the url before they are opened by the user - resulting with the error Your login link is not valid. Please request a new one..
By copying the URL and pasting in the browser manually, it works normally.

Suggested solutions

1. Before validating the magiclink GET parameter, the user has to click a button "Log in"
2. Somehow determine if the request comes from a user (research if the problematic requests are only HEAD - maybe it could be separated that way)
3. Try to add a javascript redirect on the page, that probably won't be followed by crawlers

Step to reproduce

Enable the passwordless_activated system setting, enter an e-mail that uses Office 365 and click the URL. It will show as invalid.

Environment

MODX 3.1.2, running on MODX Cloud, PHP 8.1.29.

[rthrash]

Similar: https://nhost.io/blog/protect-magic-links-from-email-clients

[rthrash]

Also similar: supabase/auth#1214