Skip to content

fix(fxa-settings): skip passwordless OTP redirect for cached sessions#20195

Merged
vbudhram merged 1 commit intomainfrom
fix-passwordless
Mar 17, 2026
Merged

fix(fxa-settings): skip passwordless OTP redirect for cached sessions#20195
vbudhram merged 1 commit intomainfrom
fix-passwordless

Conversation

@vbudhram
Copy link
Copy Markdown
Contributor

@vbudhram vbudhram commented Mar 16, 2026

Because

  • Passwordless users with a valid cached session (sessionToken in localStorage) were redirected to the OTP code page when navigating to / or /signin
  • This happened via both the Index container (email-first auto-submit) and the Signin container (direct navigation), forcing unnecessary re-authentication

This pull request

  • Adds !sessionToken guard in Signin/container.tsx to skip the passwordless OTP redirect when a cached session exists
  • Adds hasCachedSession check in Index/container.tsx handleSuccessNavigation — reads currentAccount() fresh from localStorage at call time to detect cached sessions
  • Adds cachedAccount variable in Index container to consolidate currentAccount() || lastStoredAccount() for suggestedEmail
  • Adds passwordless OTP header logging in mail_helper.js (x-passwordless-signup-otp, x-passwordless-signin-otp)
  • Adds unit tests in both Index/container.test.tsx and Signin/container.test.tsx for cached session behavior
  • Adds Relay browser service functional test

Fixes: #20195

Checklist

  • My commit is GPG signed
  • Tests pass locally (if applicable)
  • Documentation updated (if applicable)
  • RTL rendering verified (if UI changed)

Other Information

How to test:

  1. Create a passwordless account via 123done with force_passwordless=true
  2. Complete OTP flow, confirm you're logged in
  3. Navigate to http://localhost:3030/ — should see cached signin page (avatar + email), NOT the OTP code page
  4. Navigate to http://localhost:3030/signin?email=<your-email> — same behavior

@vbudhram vbudhram requested a review from a team as a code owner March 16, 2026 18:03
Copy link
Copy Markdown
Contributor

@StaberindeZA StaberindeZA left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm! ty

@vbudhram vbudhram merged commit 74aa759 into main Mar 17, 2026
22 checks passed
@vbudhram vbudhram deleted the fix-passwordless branch March 17, 2026 16:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants