Skip to content

Conversation

@LiwaaCoder
Copy link

@LiwaaCoder LiwaaCoder commented Dec 25, 2025

Summary: In two_factor_and_totp_validate and recovery_code, the headers returned by _login_user (which contain the new session/auth cookies) were being ignored. This caused the session to be invalidated immediately after the HTTP 303 redirect.

Fix: captured the headers from _login_user and passed them to HTTPSeeOther.

Related Issue: "Fixes #19222"

@LiwaaCoder LiwaaCoder requested a review from a team as a code owner December 25, 2025 13:05
@LiwaaCoder
Copy link
Author

Transltion ready

@chigwell
Copy link

chigwell commented Jan 3, 2026

@LiwaaCoder Could you please lint ./warehouse/accounts/views.py using:

python -m flake8 .

to fix the failed pipeline: https://github.com/pypi/warehouse/actions/runs/20603008465/job/59214735297?pr=19223#step:5:13

@cofiem
Copy link
Contributor

cofiem commented Jan 3, 2026

@LiwaaCoder Could you please lint ./warehouse/accounts/views.py using:

python -m flake8 .

to fix the failed pipeline: https://github.com/pypi/warehouse/actions/runs/20603008465/job/59214735297?pr=19223#step:5:13

Use make reformat to format code. See: https://warehouse.pypa.io/development/submitting-patches/#code

@LiwaaCoder
Copy link
Author

Thanks for the guidance! I ran the formatters locally and pushed the fixes. The linting errors should be resolved now.
@chigwell @cofiem

@LiwaaCoder LiwaaCoder requested a review from Trancendos January 5, 2026 11:56
@di
Copy link
Member

di commented Jan 6, 2026

This is not the cause of #19222 and will have no effect, see #19261.

@di di closed this Jan 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Login fails after 2FA: “Session invalidated” shown and user remains logged out (303 redirect from /account/two-factor)

5 participants