Satisfaction rating submitted by non-requesters

Question

The ticket requester hasn't responded to the satisfaction survey. However, a rating is posted on the ticket. How did this happen?

Answer

The survey is designed to collect only the ticket requester's satisfaction rating, but the user doesn't have to be logged in to rate their tickets. The survey is sent to the requester's email, and from there the user can click one of the options (bad or good). Each option is a temporary URL which prompts to the survey page. For more information, see Using customer satisfaction ratings.

To enable this functionality, the system embeds a unique token into the temporary URLs which connects the submitted rating with the corresponding ticket. Here what the token looks like: 

Because the survey URLs are shared just with the ticket requesters, only they have access to the rating submission page. However, if the requester forwards the satisfaction survey email or shares the URL with someone else, this action will entitle the person to modify the rating on behalf of the requester. This means that any user who has the survey URL forwarded to them can then submit the rating.

Note: There is a scenario where Zendesk Support can still prevent non-requesters from accessing the survey.  If the person who accesses the survey page is authenticated into the same Zendesk account, as the ticket requester, the system will prevent the user from accessing the survey and will direct them to a default "access denied" page.