Approval Email - issue when they are forwarded to another user

[Anonymous]

Hi Flow Peoples,

We found that if you forward an approval email another user can click on the approve button and the flow will still trigger and pick up the original recipients credentials to process the approval.

i know this might not happen much, but it has happened in testing an app we've built for a client. 

Is there a known workaround to recognise the actual user who clicks the Approve button in the email so we can validate the person clicking the button? We've tried Get My Profile - but this registers the recipient of the approval email as the person clicking the button - not the user who did.. so running out of options other than proposing we dont use the approval email method.

Cheers

[v-micsh-msft]

Hi @Anonymous,

Thanks for reporting this.

There is an old thread talking about the same issue:

See here

Looping @telu for this issue.

Regards,

Michael

[Anonymous]

If it’s just to make sure only the original recipient is the only one able to approve you could try this:

Send the approval email, when approval response is received send another approval email/email with options, confirming the first response. Unlikely both emails will end up in someone else’s inbox.

[beans]

This is not a very good option from a security perspective. is there a way to find out who the approver is in case it is forwarded to someone else?  Or block all forwards?

[Anonymous]

Best approach is to not use this - and to use the flow approvals action instead. We are only using the outlook action for notifications now.