Skip to content

Resolve "Redirect loop when logging in for the experimental sign_up flow"

What does this MR do?

It skips the check_two_factor_requirement before_action for the RegistrationsController#welcome and RegistrationsController#update_registration actions. This prevents an infinite loop on GitLab.com, when a user requires 2FA from their group. This is caused by:

  1. User visits /users/sign_up and posts form
  2. RegistrationsController#create calls the required_signup_info before_action, which leads to a redirect to /users/sign_up/welcome
  3. RegistrationsController#welcome includes EnforcesTwoFactorAuthentication module and calls the check_two_factor_requirement before_action, which leads to a redirect to /profile/two_factor_auth
  4. Profiles::TwoFactorAuthsController#show calls the required_signup_info before_action, which leads to a redirect to /users/sign_up/welcome

etc.

Screenshots

Does this MR meet the acceptance criteria?

Conformity

Availability and Testing

Security

If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

  • Label as security and @ mention @gitlab-com/gl-security/appsec
  • The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • Security reports checked/validated by a reviewer from the AppSec team

Closes #215955 (closed)

Edited by Alex Buijs

Merge request reports