-
Notifications
You must be signed in to change notification settings - Fork 87
Description
Describe the bug
As part of element-x-android#6143 / element-x-ios#5053 we're adding a login_hint for the account from Element Classic when opening MAS to sign in. This works as expected if the user hasn't signed into their MAS instance yet (or if they're already signed into MAS), but when they're signed in with a different account then the consent page is shown for that account with no indication that it isn't the expected account.
The relevant parts (I think) of an example URL on matrix.org look like this:
https://account.matrix.org/authorize?…&prompt=consent&login_hint=mxid%3A%40alice%3Amatrix.org
To Reproduce
Steps to reproduce the behavior:
- Login to MAS as bob
- Generate an authorisation URL for a new login using the consent prompt and adding a login hint for alice
- Open the URL
Expected behavior
Some kind of "you're currently signed in as bob, but this action requires signing in as alice" alert.
Screenshots
I don't think this is particularly helpful, here's the consent screen showing a different account to the supplied hint:
Desktop (please complete the following information):
N/A
Smartphone (please complete the following information):
- Device: iPhone 12
- OS: 26.3
- Browser Safari
- Version 26.3?
Additional context
N/A