Daniel Holbert [:dholbert] Reporter
	Description • 7 years ago

Today, one of my machines had lost its bugzilla logged-in status.  And when I logged in, I found that my account was in a "you must reset your bugzilla password" state.

Unfortunately: while I was in this state [i.e. until I relented and completed the form by deciding on a new password], *all bugzilla pages* (including e.g. https://bugzilla.mozilla.org/show_bug.cgi?id=1401416 or other arbitrary public bug pages) would be forcibly redirected to https://bugzilla.mozilla.org/reset_password.cgi , the password-reset page.

This is quite problematic -- it meant any previously-bugzilla tab that I viewed/ (or perhaps that I reloaded -- I'm not sure) would *lose its URL* and lose track of whatever bug it had previously been viewing.

I (and other mozilla developers) tend to maintain an informal "to-do" / "bugs-to-check-back-on" list, via our list of open tabs.  So, bugzilla's force-redirect behavior here ended up effectively destroying some items from my to-do list, by redirecting them away from the bugs they'd previously been viewing. :(

Can we adjust the password-reset flow so that it doesn't trigger this?

	Dylan Hardison [:dylan] (he/him) Assignee
	Comment 1 • 7 years ago

We can preserve the URL I think.

	Dylan Hardison [:dylan] (he/him) Assignee
	Comment 2 • 7 years ago

My attempt at securely redirecting urls is failing, probably because my brain is mush

	Dylan Hardison [:dylan] (he/him) Assignee
	Comment 3 • 7 years ago

Comment on attachment 8911388 [details] [review]
WIP PR

r=seban