Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Click Back Button from an app in sso dashboard returns error page #229

Open
viorelaioia-zz opened this issue Feb 23, 2018 · 4 comments
Open

Comments

@viorelaioia-zz
Copy link

viorelaioia-zz commented Feb 23, 2018

In sso dashboard, when clicking on an app, a new tab is opened and the user is first redirected to nlx (which does the auto login), then to the RP. So in the new tab we have a Back because nlx is in the history.
When clicking the Back button, an error page is shown when going back to nlx (different error pages for different RPs - see below screenshots for mozillians and phonebook). I believe this is not a good UX. We should maybe change the message that is shown when the users clicks the Back button.

mozillians-bad request
phonebook

@viorelaioia-zz
Copy link
Author

This was fixed by not showing nlx in history when clicking an app from the dashboard. This is working for most RPs, but there are still RPs that have the back button active and clicking it returns error page:

  • Amplitude
  • Egencia
  • Greenhouse
  • Mana
  • MDC
  • Phonebook
  • PlanSource benefits
  • Status page
  • Service now
  • Workday
  • Slack

@andrewkrug
Copy link
Contributor

These are all SAML apps. I don't think that this is fixable for these properties.

@gdestuynder
Copy link
Contributor

gdestuynder commented Mar 18, 2019

we could handle the back button redirect in SSO dashboard by forcing the user to stay on the page with the regular warning of a modified page, so that they click the button isntead of hitting back

otherwise, this should be an auth0 ticket so that they redirect (see https://community.auth0.com/t/error-when-hitting-back-button-from-sso-and-trying-to-login-via-email-password/11572)

@gdestuynder
Copy link
Contributor

Another thing that's possible, which i tested in dev is to change the error page to a specific URL such as https://sso.mozilla.com
However this option has zero data on the error, and no actual code or js running on an auth0 page (its purely a 302) so all we can do is have some kind of /error-signing type route which just say "Hey you could not sign in because you used the browser back button, please try to login again" (not great, but maybe better?)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants