What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 129 Stack Exchange communities.
  1. Go to http://meta.stackoverflow.com/users/account-recovery

  2. Enter invalid email and submit (It will display an error "Invalid email address" and the login link appear)

  3. Click login link to log in (URL in address bar is now
    http://meta.stackoverflow.com/users/login?returnurl=/users/account-recovery)

  4. Login using OpenID account provider

  5. You're then redirected back to SO after authentication and it will show you Account Recovery page and it seems you are not logged in

  6. Click any link on that page

  7. It will show you as logged in.

This flow may be OK for you but if my application show this type of flow, I am 99% sure that our (very strict) team tester will report it to our team lead and I am 99% sure that my team lead will ask me not to use /users/account-recovery as returnurl param in URL any time.

share|improve this question

1 Answer 1

up vote 2 down vote accepted

This is by design -- the account recovery page is not designed for logged in users, and does not check the user login state.

Though you're right -- we do block other return URLs that are confusing, so I can block this one as well...

share|improve this answer
    
Read: Static webpages are just much better on the server resources. This page does not expect the user to be logged in, thus, don't return a user state. –  Mark Tomlin Apr 5 '10 at 2:32
    
@Mark: Yeah, because /account-recovery receives soo many hits it will certainly make a difference whether it's static or not =) –  Andreas Bonini Apr 10 '10 at 7:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .