Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Account verification seems stuck when logged out #298

Closed
th0rgall opened this issue Jan 25, 2023 · 0 comments
Closed

Account verification seems stuck when logged out #298

th0rgall opened this issue Jan 25, 2023 · 0 comments

Comments

@th0rgall
Copy link
Contributor

th0rgall commented Jan 25, 2023

CleanShot 2023-01-25 at 19 34 05@2x

When opening a verification link in a different window context (incognito, or a different device), the following seems to happen:

  1. Firebase initialises with the API key as expected (but the user is not logged in)
  2. The /auth/action loads, and also verifies the email
  3. The user reload fails because the user is not logged in

So the email is actually verified, but it seems like it is not.

Expected behaviour

  1. Detect that the user is logged out.
  2. Notify that the verification was successful, and that the user should now sign in.
  3. Redirect to the sign-in page

It's possible to test this behavior locally in demo-test by taking local auth email verification URLs of the form
http://127.0.0.1:9099/emulator/action?mode=verifyEmail&lang=en&oobCode=acvMMiEBzu1Zj8U6uOI0xdjcF_sSXdu9BHAVf0xp0dyI0C1HpnQizy&apiKey=fake-api-key&continueUrl=http%3A%2F%2Flocalhost%3A5173%2Faccount and pasting the ?... bit after http://localhost:5173/auth/action manually.

When you don't do this manual edit, the following local auth email verification handling applies that is not really relevant, because it is different from the production behavior:

With an emulator auth test (demo-test), and the verification link opened in a new incognito window (or on a different device), the continueUrl /account redirects to the sign in page because of:

if (!$user) {
goto(routes.SIGN_IN);
}
- in this case the account gets verified, but the user is not notified that it got verified.

Notes

I might have recently broken this with the new changes of moving the "Verified" notification logic outside of auth/action, see #98 (comment)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant