getsentry / getsentry/sentry

Users are unable to perform certain actions that require password confirmation

Open
#61,265 9 comments 1 reaction 0 assignees View on GitHub
Auth Product Area: Settings - Auth Waiting for: Product Owner
Dominant language
Python
Stars
44.8k
Forks
4.9k
Avg merge
22h 21m
Merged PRs (30d)
586

Description

### Environment

SaaS ([https://sentry.io/]())

### Steps to Reproduce

1. Have one of the following:

* 2FA enabled
* OAuth login with Google, Azure or Github (not SSO).

2. Try to perform an action such as Delete a project or team, cancel the subscription, or remove 2FA.
3. Have a prompt to confirm password to complete the action.

### Expected Result

If user does not have a password -> ask to re-authenticate with Google, Github or Azure
If the user has 2FA -> Prompt password and trigger 2FA flow

After completing the re-authentication, the action is completed.

### Actual Result

Users that use Oauth to login -> have a password prompt, but these users do not have a password to confirm and are unable to proceed

Users that have 2FA -> will be able to confirm password but the flow never triggers the 2FA authentication, this results in a 401 unauthorised error and the user is unable to proceed.

The current workaround is to login using an incognito window and try to perform the action. The recent login will not trigger the password confirmation prompt.

Originally filled as an [internal issue](), creating this issue for public access.

### Product Area

Sign In

### Link

*No response*

### DSN

*No response*

### Version

*No response*

Linked Jira ticket: [Jira]()

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.