Skip to content

v0.10.2 - Auth UX Improvements & Email Deliverability

Choose a tag to compare

View all tags
@alexeykrol alexeykrol released this 11 Jan 05:07
· 30 commits to main since this release
v0.10.2
f2bc082

v0.10.2 - Auth UX Improvements & Email Deliverability

🔧 Major Fixes

Eliminated 76% authentication failure rate and fixed email spam issues

Problems Solved

  • ❌ 76% auth failure rate caused by otp_expired errors
  • ❌ Users clicking submit multiple times when emails landed in spam
  • ❌ Each click invalidated previous OTP tokens
  • ❌ Magic Link emails landing in spam folder (100% spam rate)
  • ❌ No protection against double-clicks on auth buttons

Solution

Frontend In-Flight Guards (auth-form.html)

  • ✅ Added button disable logic during email submission
  • ✅ Loading states: "Отправляем..." (Sending), "Перенаправляем..." (Redirecting)
  • ✅ Prevents multiple simultaneous requests
  • ✅ Visual feedback for ongoing operations

Resend Cooldown System

  • ✅ 60-second cooldown timer on resend button
  • ✅ Countdown display: "Повторная отправка через 60 сек"
  • ✅ Automatic re-enable after cooldown expires
  • ✅ Prevents OTP token invalidation from rapid resends

Critical User Messaging

  • ✅ Added prominent warning: "⚠️ ВАЖНО: используйте САМОЕ НОВОЕ письмо"
  • ✅ Updated error messages to discourage immediate retry
  • ✅ Clear instructions about using newest email
  • ✅ Reduces user confusion during auth flow

Email Deliverability Fix

  • ✅ Analyzed spam filter triggers in Magic Link email template
  • ✅ Optimized Amazon SES email template content
  • ✅ Removed spam-triggering phrases and formatting
  • ✅ Result: 100% spam rate → 0% spam rate

Callback Timeout Monitoring

  • ✅ Added silent 20-second timeout safeguard
  • ✅ Diagnostic stage tracking (loading, extracting, authenticating)
  • ✅ Fallback UI: "Вход занял слишком много времени" + retry button
  • ✅ Backend logging endpoint: sb_ajax_log_auth_timeout
  • ✅ Logs to wp-content/debug.log for analysis

Provider Tracking Telemetry

  • ✅ Added provider tracking: magic_link, google, facebook
  • ✅ Helps identify which auth method has issues
  • ✅ Integrated into callback timeout monitoring
  • ✅ Analytics for auth success/failure by provider

File Cleanup

  • ✅ Renamed test-no-elem-2-wordpress-paste.html → callback.html
  • ✅ Removed internal Supabase files from GitHub repository
  • ✅ Cleaner repository structure

Production Results

Metric Before After
Failure Rate 12 failures/45min (76%) 0 failures/20min+ (0%)
Email Delivery 100% spam 0% spam (inbox)
User Experience Confusing errors Smooth flow, clear recovery

Root Cause Analysis

  • 37 users (16%) made multiple Magic Link requests
  • One user clicked 8 times in rapid succession
  • Each new request invalidated previous OTP token
  • Flow: Email in spam → User clicks resend → Token expired → otp_expired error
  • Lack of cooldown and in-flight guards enabled this behavior

Files Modified

  • auth-form.html - In-flight guards, cooldown timer, critical messaging
  • callback.html - Timeout monitoring, provider tracking, fallback UI
  • supabase-bridge.php - Timeout logging endpoint, telemetry support
  • Amazon SES email template - Spam filter optimization

Deployment

✅ Deployed to production (alexeykrol.com) on 2026-01-11
✅ All auth methods working (Magic Link, Google OAuth, Facebook OAuth)
✅ Zero failures observed post-deployment
✅ Email inbox delivery confirmed

Assets 2
Loading