Cross-workspace login redirects to wrong subdomain on first attempt when following email deep link
- Dominant language
- Python
- Stars
- 44.8k
- Forks
- 4.9k
- Avg merge
- 21h 10m
- Merged PRs (30d)
- 635
Description
### Environment
SaaS (https://sentry.io/)
### Steps to Reproduce
1. Log into Sentry for the **Foo** workspace (`foo.sentry.io`) using your Foo-associated account.
2. While still authenticated, receive an email notification for an issue in a *different* workspace, **Bar** (`bar.sentry.io`).
3. Click the **"View on Sentry"** link in that email (deep link to `bar.sentry.io`).
4. Sentry detects that the currently logged-in Foo account is not a member of the Bar workspace and displays a message indicating this mismatch.
5. From that screen (`bar.sentry.io`), proceed to log in with valid **Bar** credentials.
6. Submit the login form on `bar.sentry.io`.
### Expected Result
After entering valid Bar credentials, the user is authenticated into the **Bar workspace** (`bar.sentry.io`) and taken to the issue referenced in the email.
### Actual Result
- After submitting valid Bar credentials, the user is redirected to **`foo.sentry.io`** instead of remaining on `bar.sentry.io`.
- Authentication fails because the Bar credentials are not valid for the Foo workspace/session.
- If the user repeats the exact same flow (clicks the email link again and logs in again), authentication succeeds and the user is correctly logged into **Bar**.
### Product Area
Sign In
### Link
_No response_
### DSN
_No response_
### Version
_No response_
Contributor guide
Research direction
Start by reproducing the email deep-link flow on sentry.io with two workspaces, then trace the sign-in redirect and session handling when the initial workspace differs from the target subdomain. Done means the first valid Bar login remains on bar.sentry.io and opens the issue from the email.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- authentication, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100