Describe the issue or problem
This topic relates to "Your ORCID iD could not be verified. The link is no longer valid." but I have found a specific cause and solution to this problem in our case which was not discovered or discussed in the previous thread.
I believe this affects a lot of users when they try to authorize their ORCiD iD with submissions in OJS.
The user receives an e-mail from OJS with a one time use link to authorize OJS to register the submission with the user’s ORCiD profile.
The user clicks the link to authorize it, but gets the following message in plugins/generic/orcidProfile/locale/en_US/locale.po (in OJS 3.3.0-22):
msgid “plugins.generic.orcidProfile.verify.failure”
msgstr “Your ORCID iD could not be verified. The link is no longer valid.”
In newer versions of OJS this msgid might be: orcid.verify.failure in “PKP Web Application Library”
What application are you using?
OJS 3.3.0-22, but I believe this problem exists in newer versions as well
Cause in our case: one-time-use authorization links in e-mail are “obsoleted” by checklinks security feature designed to protect against threats such as phishing and malware
Our institution’s e-mail software (Microsoft 365) has a common security feature where. When a user clicks an url which has not explicitly been whitelisted in said security feature, the url is first checked using a checklink feature.
This security feature will actually visit that url and scan the webpage for threats. If the target is safe, the user is redirected to the url.
The problem is that the ORCiD urls are one-time use. The security feature intercepts the users who wish to follow the url.
By the time the user is able to visit the url a couple of seconds later, the security feature already visited the url and the ORCiD was authorized, and further use of the url was invalidated. The user, however is notified that registration was unsuccessful because the link is no longer valid.
I had our IT department whitelist these ORCiD activation urls for our in-house e-mail security, so these links will no longer be checked automatically and this solves the problem for our in-house authors from our e-mail domain. But we have obviously no control over this for other e-mail servers, and most of the authors have other e-mail domains.
I propose some solutions to this problem:
One fix to remedy this until a better solution is in place is to change msgstr for plugins.generic.orcidProfile.verify.failure or orcid.verify.failure (in newer OJS versions) is to include a description of possible cause such as:
msgstr “Your ORCID iD could not be verified. The link is no longer valid. Or maybe the one-time-use authorization link was already activated by your e-mail link scanner security feature, in which case your ORCID iD could have been successfully verified!”
How to address this before it is properly handled in the code:
The error message can be overridden using custom locale plugin, or by modifying the locale.po file on the server.
But we have to remember this every time we upgrade OJS until this issue is properly addressed.
A better solution?
Add a new context such as:
orcid.verify.failure.previously-authorized
msgstr “Your ORCiD iD is already authorized”
Add some functionality when handling this error:
When receiving the status that indicates that the link is invalid the code should do a check to see if the publication has already been been authorized with this user’s ORCID iD. This should be possible to do with a database query. If it is already authorized, please notice the user that the ORCiD iD is already authorized.
If it hasn’t been authorized, display the current message: “Your ORCID iD could not be verified. The link is no longer valid”
Another solution?
Could the ORCiD api have a status code that would indicate that the id was already authorized for that publication, which the ORCiD functionality in OJS could meanifully convey to the end user?
Best Regards,
Eirik Hanssen
University Library
Oslo Metropolitan University