1055870 - "Signed in with..." icon is wrong.

Status: RESOLVED FIXED

(developer.mozilla.org Graveyard :: Sign-in, defect)

Description

[Stephanie Hobson [:shobson]]

Attachment: signedin.jpg

The GitHub icon appears next to my name when I'm signed in with Persona. The icon appears both next to the username in the site header and next to the username on the edit profile page. It is intended to match the service the user used to sign in with ;)

Comment 1

[David Walsh :davidwalsh]

Phew, I thought I noticed that as well. Good catch!

Comment 2

[David Walsh :davidwalsh]

Feel free to overrule me here but I consider this major and a deeper problem than a wrong icon.  Here's our current logic for displaying said icon:

```
{% if request.session.sociallogin_provider == 'persona' %}
    <i aria-hidden="true" class="icon-user" title="{{ _('Signed in with Persona') }}"></i>
{% elif request.session.sociallogin_provider == 'github' %}
    <i aria-hidden="true" class="icon-github" title="{{ _('Signed in with GitHub') }}"></i>
{% endif %}
```

If we can't count on `request.session.sociallogin_provider`, that's a real problem

Comment 3

[Stephanie Hobson [:shobson]]

It's possible that I was signed in with GitHub and had authorized MDN but that it was not associated with my account but yes, that would make it unreliable :(

Comment 4

[Luke Crouch [:groovecoder]]

Investigation results: We only use this session variable to display the icon, so we're not leaking sessions that could compromise users' auth.

We set this session variable in our `on_pre_social_login` signal receiver:

https://github.com/mozilla/kuma/blob/master/kuma/users/models.py#L197-208

If the variable already exists in the session, we don't reset/over-write it. So, if the user initiates any 2 social auth processes in the same session, we will always show their first one.

So I can reproduce this by:

1. Start GitHub Sign-up process
2. Click "Yes, connect with my MDN profile"
3. Start & Complete Persona Sign-in process
4. Land back on MDN with GitHub icon

or

1. Start Persona Sign-up process
2. Complete auth in the Persona window
2. Don't complete MDN Sign-up process (just click home link)
3. Sign in with GitHub
4. Land back on MDN with Persona icon

:shobson - I propose we simply remove if `if 'sociallogin_provider not in request.session` line to always show the icon of the most recently-completed auth service. You approve?

Comment 5

[Stephanie Hobson [:shobson]]

:groovecoder Make it so :)

Comment 6

[Luke Crouch [:groovecoder]]

https://github.com/mozilla/kuma/pull/2709

Comment 7

[[github robot]]

Commits pushed to master at https://github.com/mozilla/kuma

https://github.com/mozilla/kuma/commit/e1cd1886593dd31a83192da9f49c5339e56f2963
fix bug 1055870 - always overwrite provider session variable during social sign-in

https://github.com/mozilla/kuma/commit/f3f132ae964b4a5be1100932072061afcdab197f
Merge pull request #2709 from groovecoder/signed-in-icon-1055870

fix bug 1055870: "Signed in with..." icon is wrong.