1. Go to https://meta.stackoverflow.com/users/account-recovery

  2. Enter invalid email and submit (It will display an error "Invalid email address" and the login link appear)

  3. Click login link to log in (URL in address bar is now

  4. Login using OpenID account provider

  5. You're then redirected back to SO after authentication and it will show you Account Recovery page and it seems you are not logged in

  6. Click any link on that page

  7. It will show you as logged in.

This flow may be OK for you but if my application show this type of flow, I am 99% sure that our (very strict) team tester will report it to our team lead and I am 99% sure that my team lead will ask me not to use /users/account-recovery as returnurl param in URL any time.


This is by design -- the account recovery page is not designed for logged in users, and does not check the user login state.

Though you're right -- we do block other return URLs that are confusing, so I can block this one as well...

  • Read: Static webpages are just much better on the server resources. This page does not expect the user to be logged in, thus, don't return a user state. Apr 5 '10 at 2:32
  • @Mark: Yeah, because /account-recovery receives soo many hits it will certainly make a difference whether it's static or not =) Apr 10 '10 at 7:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .