723625 - browserid: redirect sign-ins away from /users/login

Status: VERIFIED FIXED

(developer.mozilla.org Graveyard :: Wiki pages, defect)

Description

[Luke Crouch [:groovecoder]]

Going to /users/login logs the user out. Never send a user to /users/login as part of the login flow. Send them to the home page instead.

Comment 1

[Luke Crouch [:groovecoder]]

First request to /users/login should capture the referring url and send THAT to browserid for the ultimate redirection, not the /users/login url again.

Comment 2

[Les Orchard [:lorchard]]

My $0.02:

When already logged in: Instead of sending them to home, remove the logout code and display a message saying something like "You're already logged in." Might be confusing to a user... eg. "How'd I end up on the home page?"

When logging in: Yeah, we should capture the ?next or referer in the session on the first hit and then ultimately redirect to that on successful login. Unless the URL captured is empty or /users/login itself - in which case, we should bounce to home page. (Seems not as confusing in this case)

Comment 3

[Gregg Lind (Fx Strategy and Insights - Shield - Heartbeat )]

My related flow failure:

to reproduce:

0.  (while logged out)
1.  url:  https://developer.mozilla.org/en/Observer_Notifications  # for example
2.  EDIT -> redirects to https://developer.mozilla.org/en-US/users/login
3.  sign-in -> browser id popup.
4.  (do that).  Nothing on the page changes.  No redirect, no change to the 'top nav' area.
5.  (sometimes) if I go back to the original page and  'hard refresh' it updates.  

Expected:

after step 4, expected redirect to the intital page with credentials (prefered), OR credentials to be reflected
in the top nav area OR redirect to a "you're logged in, awesome!" page.

Comment 4

[Les Orchard [:lorchard]]

Another URL TO consider: /users/browserid_register

If this is the session-captured next or referer URL, we should redirect to home instead. I've had a few cases where I get sent back to that page when I follow up an login with an unknown email by an email for which I do have an account.

Comment 5

[[github robot]]

Commits pushed to mdn at https://github.com/mozilla/kuma

https://github.com/mozilla/kuma/commit/49f771fe58fe41058aad28807e378862479e93ba
Bug 723625 fix _clean_next_url for login urls

include browserid_register as a looping link

https://github.com/mozilla/kuma/commit/e2325b1ba41f84e6c99c0b20b4bb8c8f02b6adc5
Merge pull request #111 from groovecoder/723625-users-login-redirects

Bug 723625 fix _clean_next_url for login urls

Comment 6

[Les Orchard [:lorchard]]

I don't think we're capturing the ?next into a session, and so the info gets lost on the way through the registration process

Comment 8

[[github robot]]

Commits pushed to mdn_prod at https://github.com/mozilla/kuma

https://github.com/mozilla/kuma/commit/49f771fe58fe41058aad28807e378862479e93ba
Bug 723625 fix _clean_next_url for login urls

https://github.com/mozilla/kuma/commit/e2325b1ba41f84e6c99c0b20b4bb8c8f02b6adc5
Merge pull request #111 from groovecoder/723625-users-login-redirects

Comment 9

[Luke Crouch [:groovecoder]]

Duh. This is still 2.3 bug.

Comment 10

[raymond [:retornam] (inactive)]

qa-verified-stage9 https://developer-stage9.mozilla.org/en/Observer+Notifications redirect works after sign in

Comment 11

[raymond [:retornam] (inactive)]

verified fixed https://developer.mozilla.org/en/Observer+Notifications