Wordpress-ios: Login: "Your session has expired" notice shown for 2FA Google login despite being logged in successfully

[designsimply]

Steps to reproduce:

1. Start with an account with Google sign-in and two-factor authentication enabled.
2. Tap "Log in".
3. Tap "Continue with Google".
4. Get the verification code from your authenticator app.
5. Enter the verification code into the app.
6. Tap "Next".

Result: I often get a session expired notice even though I am logged in successfully. When I tap "OK" then I am taken to the app as logged in. (1m18s)

Your session has expired, please go back to the login screen.

^{Tested with WPiOS 14.5.0.1 TestFlight beta on iPhone 11 iOS 13.4.}

[mindgraffiti]

Hi @designsimply!

A quick search for the error message leads me to believe that it's an API error from Google. The next time you see this, would you copy & paste your activity log? It would also be helpful to know if this happened on March 26, 2020 (the day that google had several services go down at the same time) or if it's consistent for you.

I've added it to our UL&S backlog for further investigating.

[designsimply]

A quick search for the error message leads me to believe that it's an API error from Google.

Yes, but should I see an API error in the app if the login goes through normally? It tells me to go back and log in but I am already logged in at that point—also, I'm entering the code in fairly quickly so I don't think the sessions should have expired yet!

Video: 1m49s
App logs: session-expired-notice-for-successful-2fa-google-sign-in-wpios-14.6-beta-13806.txt

^{Tested with WPiOS 14.6.0.1 TestFlight beta on iPhone 6S iOS 13.3.1.}

It would also be helpful to know if this happened on March 26, 2020

Nope, and this issue happens for me fairly often. I've tested login many many times today and I've seen the session expired error for successful Google sign in flows several times.

[designsimply]

I think I figured it out! I think it happens if you tap "Next" more than once on the screen where you enter the verification code.

Video: 2m18s
App logs: app-logs-with-and-without-expired-session-notice-for-successful-login.txt

^{Tested with WP Internal 14.6.0.20200410 MS App Center alpha on iPhone 6S iOS 13.3.1.}

[mindgraffiti]

Activity Log snippet

WordPress[84734:7494388] 🔵 Tracked: login_failed_to_login <error_code: 0, error_description: Error Domain=WordPressComOAuthError Code=0 "two_step_nonce required." UserInfo={NSLocalizedDescription=two_step_nonce required., WordPressComOAuthErrorResponseObjectKey={
                code = "empty_two_step_nonce";
                message = "two_step_nonce required.";
2020-05-11 08:27:35:079 WordPress[84734:7494388] two_step_nonce required.
                code = "invalid_two_step_nonce";
                code = "invalid_two_step_nonce";
                code = "invalid_two_step_nonce";

[mindgraffiti]

Notes dump

If I've never signed up for WP using a Google account, and then I go to the sign-in, it will silently start the sign up process and ask me for a 2fa code. BUT the WP.com account 2fa won't work. It'll error out and post "invalid_two_step_nonce" as the alert message. The 2fa code is TEXTED to you.

I had previously quickly logged into my WP.com email account, then logged out and tried to quickly log in with my Google account. The 2fa codes were entered fairly quickly, and the pop up about "you session has expired" appeared before I even entered a 2fa for Google.

[designsimply]

The 2fa codes were entered fairly quickly, and the pop up about "you session has expired" appeared before I even entered a 2fa for Google.

🤔 possibly a separate issue as well?? See https://github.com/wordpress-mobile/WordPress-iOS/issues/13807#issuecomment-612236448. It seems you can't do these kinds of logins too closely together.

[mindgraffiti]

Need to research this next week and verify it is still a problem. I think we fixed this issue because all the "pink" buttons now use the NUX button that blocks users from tapping fast and submitting twice

[mindgraffiti]

Moving to Groundskeeping as the UL&S project is wrapping up. While I didn't encounter this error during UL&S work, I'm leaving it open because I can't confirm that it was fixed.