security: alert user to confirm email with CERN login #862
Labels
complexity: medium
priority: medium
type: bug
Indicates an unexpected problem or unintended behaviour
The
invenio-oauthclient
package (since v2.1.0 released 2022-12-19) now automatically confirms new users signed up with a CERN account (commit). See Auto-confirm user in the InvenioRDM docs. However, it seems that if users signed up to HEPData with a CERN account when an earlier version ofinvenio-oauthclient
was deployed, and they did not confirm their email address at the time, they are now redirected to the home page with a URLhttps://www.hepdata.net/?message=Unauthorized.&code=401
without seeing the flash message asking them to resend the confirmation email from https://www.hepdata.net/confirm that was added in PR #177. A more user-friendly error message should be returned in this (relatively rare) case.The text was updated successfully, but these errors were encountered: