1556506 - No success message is displayed when the user signs out, UI is confusing.

Status: RESOLVED WONTFIX

(Cloud Services :: Server: Firefox Accounts, enhancement)

Description

[Gene Wood [:gene]]

In Firefox 67, when attempting to disconnect a device from Firefox Accounts, FxA won't disconnect the device and instead re-connects the device.

Here's a video showing the experience

https://youtu.be/goRhLXGCOWk

This is reproducible 100% of the time.

Comment 1

[Ryan Kelly [:rfkelly]]

Thanks for the report Gene!

Following the video here, you do the following steps:

1. Visit your "manage account" prefs from within Firefox
2. Disconnect the current device, which signs you out sync
3. Get redirected back to the sync signin page.
4. Sign back in to sync.
5. Visit your "manage account" prefs from within Firefox again

Step (4) above is reconnecting your Firefox to Sync, causing it to show up again in the list. From the description, it sounds like you were expecting it to only sign you on in the web rather than reconnect to sync?

Comment 2

[Gene Wood [:gene]]

Ah, this must be a UI challenge then, not a technical challenge.

I assumed that it was verifying that I was authorized to disassociate the device by providing a login challenge to make sure it was me. Users see this flow a lot I think. For example, user is logged into Google, can do all kinda of Google actions, but when they go to disable 2FA or change the password, Google requires that they type their password (even though they're already logged in) to make sure they are the user (and not someone sitting at their computer)

So I'd say we should do one of these

• Not redirect to the login page after disconnecting the device, but instead redirect to some "Thanks for using FxA on this device" page
• Add content to that login page clarifying that the user isn't merely logging into FxA, they're linking their Firefox with FxA

Thoughts?

Comment 3

[Ryan Kelly [:rfkelly]]

I assumed that it was verifying that I was authorized to disassociate the device by providing a login challenge to make sure it was me

Ah right, yes, I see exactly what you mean. We don't actually have such a flow in FxA at the moment but it's something we've talked about quite a bit.

Add content to that login page clarifying that the user isn't merely logging into FxA, they're linking their Firefox with FxA

The login page does say "to continue to Firefox Sync" but I can imagine it's easily missed.

Thoughts?

I'll redirect that one to :stomlinson and/or :rfeeley.

Comment 4

[Shane Tomlinson [:stomlinson]]

I thought we had a "Logout successful" message at one point, but it looks like we changed that logic so that we can generate new flow parameters [1]. While we wouldn't want to redirect to the /signin page with the actual message to display (untrusted input and all that), maybe we could redirect with a boolean that indicates "show the signout success message", or store a bit in sessionStorage that causes that message to be displayed.

[1] - https://github.com/mozilla/fxa/blob/ae233dde810d297e85bd0ddf0515f9d33ec2dca2/packages/fxa-content-server/app/scripts/views/mixins/signed-out-notification-mixin.js#L41-L42

Comment 5

[Gene Wood [:gene]]

maybe we could redirect with a boolean that indicates "show the signout success message", or store a bit in sessionStorage that causes that message to be displayed.

That sounds like a good idea!

Comment 6

[vzare]

Closing this ticket in favour of a larger project aimed at improving the messaging/experience around logged-in and logged-out states being tracked here: https://docs.google.com/document/d/1XeTw2u5ucmFY3LdUWeB1FQXa0wz-5ml_XSTG4llDVPY/edit#heading=h.8cg3mp2k3470