Passwordless | Update create account flows for existing users #3040
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
coldlink
added
the
passwordless
coldlink
force-pushed
the
mm/passcode-create-account-full
branch
from
c63c101 to
7573985
Compare
AshCorr
approved these changes
Jan 23, 2025
…ng through create account flow
…onfirmationPagePath, emailSentPage, and expiredPage
coldlink
force-pushed
the
mm/passcode-create-account-full
branch
from
7573985 to
5a719dc
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What does this change?
Currently when a reader who already has a Guardian account goes through the "create account" flow (
/register/email), they will not be sent a passcode, but instead an email saying they already have a Guardian account and to sign in or reset their password, and shown a generic "Check your inbox" page. This differs from how it works for new users, who get a passcode after entering their email on the create account page.This isn't ideal. Firstly the user experience is different and unexpected, especially as we use passcodes in all other scenarios now (sign in + reset password). It also a small security/user data risk, specifically for username enumeration, where an attacker can find out if a given account exists depending on which page the attacker sees after entering their email.
This PR fixes this behaviour by making sure we use passcodes for all users who go through the create account flow. For new users the behaviour is exactly the same. For existing users we now send them a passcode that allows them to sign in, which piggybacks of the work done in #2942 for sign in with passcodes.
We modify the sign in with passcode controllers to allow us to display the correct email sent page (
/register/email-sent) and a different page after verifying their code (confirmationPagePath), other than that the logic/behaviour is the same as for sign in with passcodes.Existing users will see a new page after going through the create account flow, specifically the
WelcomeExistingpage on the/welcome/existingroute, which lets the user know that they already have a Guardian account, they've now signed in, and they can return to the Guardian or manage their account.Finally a whole lotta tests were added and updated in order to take into account the new create account flow for existing users.
WelcomeExistingDemo
Screen.Recording.2025-01-23.at.14.42.51.mov
Screen.Recording.2025-01-23.at.14.44.34.mov
Screen.Recording.2025-01-23.at.14.49.26.mov
Tested