Email codes are sent for login flows that don't ask for one
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 685
- Forks
- 237
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 136
Description
Description
Users keep getting email codes to confirm sign–ins even though they're not asked for one in their flow.
Steps to reproduce
From https://support.mozilla.org/en-US/questions/1596208#answer-1836377 (and similar reports):
"when I login to Mozilla support I get an email with a numerical code to prove it's me. However I can't see anywhere to input this - there was no notification at login. It doesn't stop me from logging in to support so it seems redundant."
Expected result
Codes either required to enter, or not sent out.
Actual result
Users receiving codes with no idea what to do with them.
Environment
This particular flow is https://support.mozilla.org/en-US/users/auth
┆Issue is synchronized with this Jira Task
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the login flow at support.mozilla.org/en-US/users/auth and trace how email codes are triggered and consumed. Compare the flow's requested verification state with the message-sending behavior. Done means codes are required and usable in the flow, or are not sent when no code input is presented.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- authentication
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100