Use the _external parameter when generating links for emails

flask_security/confirmable.py

@@ -15,7 +15,7 @@ from flask import current_app as app, request
 from werkzeug.local import LocalProxy
 
 from .utils import send_mail, md5, url_for_security, get_token_status,\
-     config_value
+    config_value
 from .signals import user_confirmed, confirm_instructions_sent
 
 
@@ -27,8 +27,7 @@ _datastore = LocalProxy(lambda: _security.datastore)
 
 def generate_confirmation_link(user):
     token = generate_confirmation_token(user)
-    url = url_for_security('confirm_email', token=token)
-    return request.url_root[:-1] + url, token
+    return url_for_security('confirm_email', token=token, _extenal=True), token
 
 
 def send_confirmation_instructions(user):

flask_security/passwordless.py

@@ -14,7 +14,7 @@ from werkzeug.local import LocalProxy
 
 from .signals import login_instructions_sent
 from .utils import send_mail, url_for_security, get_token_status, \
-     config_value
+    config_value
 
 
 # Convenient references
@@ -30,8 +30,7 @@ def send_login_instructions(user):
     :param token: The login token
     """
     token = generate_login_token(user)
-    url = url_for_security('token_login', token=token)
-    login_link = request.url_root[:-1] + url
+    login_link = url_for_security('token_login', token=token, _external=True)
 
     send_mail(config_value('EMAIL_SUBJECT_PASSWORDLESS'), user.email,
               'login_instructions', user=user, login_link=login_link)

flask_security/recoverable.py

@@ -14,7 +14,7 @@ from werkzeug.local import LocalProxy
 
 from .signals import password_reset, reset_password_instructions_sent
 from .utils import send_mail, md5, encrypt_password, url_for_security, \
-     get_token_status, config_value
+    get_token_status, config_value
 
 
 # Convenient references
@@ -29,8 +29,7 @@ def send_reset_password_instructions(user):
     :param user: The user to send the instructions to
     """
     token = generate_reset_password_token(user)
-    url = url_for_security('reset_password', token=token)
-    reset_link = request.url_root[:-1] + url
+    reset_link = url_for_security('reset_password', token=token, _external=True)
 
     send_mail(config_value('EMAIL_SUBJECT_PASSWORD_RESET'), user.email,
               'reset_instructions',