"Login Failed. Please try again" PreventDefault

[abhishekpatel946]

Describe the bug
A clear and concise description of what the bug is.

To Reproduce
Steps to reproduce the behavior:

1. Go to 'https://www.simplq.me/'
2. Click on 'Home'
   3 See error 'Login Failed. Please try again.'

Expected behavior
A clear and concise description of what you expected to happen.

Screenshots

Desktop (please complete the following information):

• OS: [Windows10]
• Browser [Chrome]
• Version [87]

Additional context
On the Landing page unexpected Login Failed. Please try again. or when I click on Home the same error prompt opens. I think when I landed or refresh the page the form will be submitted by default. Prevent this kind of uncertain form or click.

[daltonfury42]

Thanks @abhishekpatel946 for reporting this. I can reproduce the issue on Incognito.

[prabureddy]

@abhishekpatel946 Everything works fine in my system. Clear your cache, site settings and check again.

[daltonfury42]

Definitely we need better error reporting here. I've raised #462 once that goes in, we will get more logging. In Incognito login fails due to cookies not being enabled, we will have to figure it out later.

[daltonfury42]

@abhishekpatel946 Can you try reproducing the issue on https://dev.simplq.me?

[abhishekpatel946]

I got the point of the problem.

If we want to Block third-party cookies or Block all cookies (not recommended) in chrome.
Then the Login Failed. Cookies are not enabled in current environment. Prompt is activated.

but if we Allow all cookies in Chrome then the prompt is not active.
Note:- Same thing happens in the incognito mode in Chrome.

[abhishekpatel946]

Thanks @abhishekpatel946 for reporting this. I can reproduce the issue on Incognito.

sure 👍

[daltonfury42]

Root cause: google/google-api-javascript-client#260

This is sad.

[maaverik]

What would be the best way to suppress this error message for us? Should we just pass an extra argument to skip the handleApiErrors call in case this particular situation occurs?

[daltonfury42]

@maaverik This is not our API failing, but the google login library reporting a failure when trying to login. We should not suppress this message, but show it to the user, right? So that he enable third party cookies if he wants to login (which is the
saaad part :/)

We could show a better error message to alleviate the ugliness, but I feel we should think of a proper fix.

[maaverik]

It makes sense to show this if he tries to login, but this shows up if a user simply opens the site, which ruins user experience in my opinion. Can we modify that initial login attempt somehow?

As for the message, can we change it to something like "Please enable cookies in your browser to login"?

[daltonfury42]

I see. If we disable it, we will have to see how login will happen when the user refreshes the page. 🤔

[maaverik]

We don't need to disable it. I was thinking we could make error reporting optional for the initial login attempt on page load. Let it fail silently the first time the page loads. Although I can't think of a clean way to do this. We'd need to pass a variable all the way to the axios calls.

[daltonfury42]

ACK. We could do that. Don't know how to detect this, have to check. But still I would prefer trying to solve the root issue. We might probably have to implement server side OAuth. It will be a fun project.

This is not a axios request. It's happening here.

[daltonfury42]

We could have a flag, and suppress the first time this happens. In case of affected users, first time should always be on page reload. We could do this with some flag, but just that we are doing a hack to cover up a bug. Server side OAuth flow might be a big task, and might have some cost/complexity... Or we would have to think of a different auth provider that can give us google sign in, I don't know.

[maaverik]

Let's go with the flag. Things are pretty simple and secure with google sign-in and so far, this is the only problem, right? I think it's tolerable.

[daltonfury42]

Summarising the discussion with @maaverik, we might be better off integrating to some other provider for auth, and he suggested Okta.

I was checking it out, and Google doesn't provide SPA/React specific integration, but Octa does. So Octa might be cleaner to integrate, only that we have to pay after more than 1000 active user logins per month. This is good enough for us to evaluate.

[daltonfury42]

While google has not cared to solve it in their client library, I can see that octa is trying to solve this as a Early Release feature.