Skip to content

fix(login): always render sign-in form (fail-open on slow auth-methods) #367

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
izzywdev merged 1 commit into from
Jul 23, 2026
Merged

fix(login): always render sign-in form (fail-open on slow auth-methods) #367

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 8 additions & 2 deletions frontend/src/pages/LoginPage.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,7 +65,13 @@ function LoginPage() {
const loading = pending !== null
const [error, setError] = useState('')
const [notice, setNotice] = useState('')
const [authMethods, setAuthMethods] = useState<AuthMethods | null>(null)
// Start from the password-only fallback so the sign-in form is ALWAYS
// rendered immediately — never gated on the auth-methods fetch. `getAuthMethods`
// is progressive enhancement: when it resolves it upgrades this to advertise
// Google/MFA. Previously this was `null` and the whole form was hidden until the
// fetch resolved; when that request HUNG (its 30s timeout, not a rejection, so
// the catch never ran) the login page rendered blank and was unusable.
const [authMethods, setAuthMethods] = useState<AuthMethods>(FALLBACK_METHODS)
const { setUser } = useCurrentUser()

// Route an authenticated Security-API session into the app: hydrate the
Expand Down Expand Up @@ -300,7 +306,7 @@ function LoginPage() {
{/* Credentials form — the DEFAULT sign-in/sign-up UI, brokered entirely by
FuzeFront's own Security API (same-origin /api/v1/security). No identity
provider is named or contacted by the browser. */}
{authMethods && passwordEnabled && (
{passwordEnabled && (
<form onSubmit={handleCredentialsSubmit}>
{mode === 'signup' && (
<div style={{ display: 'flex', gap: 'var(--space-3, 12px)' }}>
Expand Down
Loading