[HELP] 502 error on redirect after email link click — only with Outlook + Windows Defender

We have a feature where users receive an email invitation and can either accept or decline it.

Flow:

• Decline → redirects to a response panel ✅ works fine
• Accept (success) → our API processes the changes correctly ✅, then redirects to a company blog post ❌ 502 error
• Accept (failure) → redirects to the landing page ✅ works fine

The 502 only fires on the final redirect to the blog post URL. The API call itself succeeds — the issue is exclusively in that redirect step.

Key detail: this only happens when the link is opened via Microsoft Outlook with Windows Defender active. It does not reproduce in any other environment (other email clients, browsers, Defender disabled, etc.).

Our current hypothesis is that Windows Defender (or Outlook's Safe Links / link scanning feature) is making a pre-emptive GET request to the redirect destination before the user actually lands there, which may be causing the server to process the request twice or hit some unexpected state.

Has anyone dealt with 502s triggered specifically by Defender/Safe Links scanning redirect URLs? Any insight on how to handle or detect these automated requests would be appreciated.

Move from Microsoft 365 y Microsoft Office | Microsoft 365 Defender | Otros | Otros