Fix finish of account recovery flow deleted web session #3527

ref #3502 (comment)

Author: tung2744

pkg/auth/handler/webapp/authflow_controller.go

@@ -562,20 +562,21 @@ func (c *AuthflowController) AdvanceWithInput(
 		result.NavigationAction = "redirect"
 		result.RedirectURI = c.deriveFinishRedirectURI(r, s, &flowResponse2)
 
-		err = c.Sessions.Delete(s.ID)
-		if err != nil {
-			return
-		}
-
 		switch flowResponse2.Type {
 		case authflow.FlowTypeLogin:
 			fallthrough
 		case authflow.FlowTypePromote:
 			fallthrough
 		case authflow.FlowTypeSignup:
 			fallthrough
+		case authflow.FlowTypeSignupLogin:
+			fallthrough
 		case authflow.FlowTypeReauth:
 			// Forget the session.
+			err = c.Sessions.Delete(s.ID)
+			if err != nil {
+				return
+			}
 			result.Cookies = append(result.Cookies, c.Cookies.ClearCookie(c.SessionCookie.Def))
 			// Reset visitor ID.
 			result.Cookies = append(result.Cookies, c.Cookies.ClearCookie(webapp.VisitorIDCookieDef))