[Bug]: Magic Link Re-login Failure: First-time Use Works, Subsequent Links Fail After Confirmation Flow

[tylerasselin]

What happened?

Description:

When a magic link is used once, it allows for successful sign in. When the same link is clicked again, the user is met with a confirmation page that has a continue button. If they click continue they are allowed to enter their email address again. If they enter their email address again and submit, they will be sent a new magic link email. When that new magic link is clicked, the login fails.

Steps to reproduce:

1. Click login with magic link
2. Click link received in email
3. Sign in is successful
4. Click same ink in email again
5. Confirmation page with continue button
6. Click Continue button
7. Link expired message w/ form to enter email again
8. Enter email again and submit
9. Get a new/second link email
10. Click link in new email

Expected Result:

• The new login with the new magic link succeeds

OR

• The confirmation flow doesn't allow the email to be submitted again

OR

• Something else that works well

Actual Result:

Sign in fails

Version

1.56.0

Affects Versions

No response

Alternatives / Workarounds

No response

[jobannon]

The above steps work do not result in a failure or bug on my machine. Using FusionAuth 1.57.0 and stock password less template.

[#setting url_escaping_charset="UTF-8"]
You have requested to log into FusionAuth using this email address. If you do not recognize this request please ignore this email.
<p>
  [#-- The optional 'state' map provided on the Start Passwordless API call is exposed in the template as 'state' --]
  [#assign url = "https://local.fusionauth.io/oauth2/passwordless/${code}?tenantId=${user.tenantId}" /]
  [#list state!{} as key, value][#if key != "tenantId" && value??][#assign url = url + "&" + key?url + "=" + value?url/][/#if][/#list]
 
  <a href="${url}">${url}</a>
</p>
- FusionAuth Admin

[robotdan]

Hmm...

I would expect:

1. The link to only work once. This is by design, and I think what @tylerasselin expects as well.
2. If the link is clicked again, and is invalid, we should try (if possible, some variables here) to let the user request another magic link.
3. If a new magic link is created, I would expect it to work one time.

I think this lines up with what @tylerasselin is asserting.

@tylerasselin have you made any changes to the templates or how the URLs are being constructed?

[tylerasselin]

@robotdan - There were no custom URLs/template changes when we reproduced this on @LucasPMorris machine last month.