Secure actions

This page documents how Gmail secures the delivery and execution of actions.

Security measures enforced by Google

The following conditions must hold for schemas embedded in email:

• Registration: The sender must register with Google.
• SPF or DKIM: Emails with schema markup must arrive from SPF- or DKIM-authenticated domains.

Additional measures required for inline actions

Extra security measures are required or recommended to secure inline actions:

• HTTPS: All actions must be handled using HTTPS URLs. Hosts must have valid SSL server certificates installed.
• Access Tokens: We recommend that senders using actions embed limited-use access tokens in action URLs to protect themselves against replay attacks. This is a recommended practice for any URL embedded in web pages or emails that might have side effects when invoked.
• Bearer Authorization: We recommend that services handling action requests verify the HTTP "Authorization" header in the HTTPS request. That header contains a bearer token string, proving that the source of the request is Google, and that the request is intended for the specified service. Services should use the Google-provided open source library to verify the bearer token.

Note: Bearer tokens in authorization headers are not sent by default. If you require a bearer token to be sent, request it when registering with Google.

Secure edge-case email access patterns

There are various email forwarding and access patterns that Gmail handles in order to secure actions in emails. The following measures are performed in addition to the measures described previously in this document:

Access Pattern	Additional Security Measures
Manual forwarding: The user opens an email and forwards it to more recipients	Such forwarding always breaks DKIM signatures, and the sender is no longer registered with the service. Actions in the email are rejected.
Auto-forwarding to Gmail: The user creates a forwarding rule on mailbox [e-mail] to their Gmail inbox.	Gmail verifies that the user can send as [e-mail] (the user configures this manually). Actions in the email are accepted.
Gmail POP fetching: The user provides Gmail the password for [e-mail] and Gmail fetches all emails there using POP to the Gmail inbox.	DKIM signatures and content integrity are preserved. The user has proven access to [e-mail]. Actions in the email are accepted.
Accessing Gmail emails with third-party applications: A Gmail user uses a third-party application (such as Outlook or Thunderbird) to access Gmail emails, or forwards their Gmail emails to another email provider.	A third-party application or service might use embedded information. However, it cannot produce bearer authentication tokens that match Google's, giving senders the opportunity to reject such action requests. Senders may choose whether they reject or accept actions without bearer tokens, depending on the sensitivity of the action. Senders can use standard open source technologies, making it possible for all email providers and apps to produce them using their own keys.