Don't delete e-mail validation sessions when the checking if the session was validated #8086
Open
Description
This issue has been migrated from #8086.
With the current e-mail validation flow the user can be presented with a blank white page that says "Unknown session_id" pretty easily. The flow is something like the following:
- The user is sent a validation e-mail.
- The e-mail validation link is clicked and Synapse ensures that the data matches and marks the e-mail as valid.
- The user gets redirected to wherever their client wants based on the
next_link
parameter. - If a user has left Element running somewhere (maybe in a background tab, or on another device) it continually polls in the background and notices that the e-mail is now valid). It then deletes the e-mail validation session.
- The application continues with whatever is left in the registration flow (or logs the user in).
Unfortunately it seems that some e-mail providers do content scanning on links, so they automatically visit a link before the user sees it. With that, the flow is modified a bit:
- Step 1 from above happens as expected.
- Before the user sees the e-mail the link is visited.
- Since there's an app polling in the background, steps 2 - 4 happen.
- The user urgently refreshes their inbox waiting for their validation email.
- Finally the user is able to click on the validation link.
- "Unknown session_id" error page 😢
I think the fix for this is to not delete the validation session during the UI Auth workflow and to delete them periodically (as we do with the UI auth sessions).