Recover customer account login from OAuth state mismatches#3856
Open
fredericoo wants to merge 1 commit into
Open
Recover customer account login from OAuth state mismatches#3856fredericoo wants to merge 1 commit into
fredericoo wants to merge 1 commit into
Conversation
Customer login could fail with an Unauthorized response when the browser context changed or a concurrent login replaced session state. Restart login once using a recovery marker carried through OAuth state, preserve existing session data, and generate state with cryptographically secure randomness. Assisted-By: devx/39bbe0bb-8821-4cda-9954-2bbeb70c1d6a
Contributor
|
Oxygen deployed a preview of your
Learn more about Hydrogen's GitHub integration. |
fredericoo
marked this pull request as ready for review
July 14, 2026 19:08
graygilmore
approved these changes
Jul 14, 2026
andguy95
approved these changes
Jul 16, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #3403
TL;DR: Customer Account login currently ends on
Bad request: Unauthorizedwhen the OAuth callback loses or replaces the storefront session state. Retry the login flow once so customers can complete authentication without re-entering their one-time code.Before
Switching from an app WebView to the system browser, or completing an older login tab, caused
customerAccount.authorize()to reject the callback and clear the customer session.After
Hydrogen redirects through the configured login route once with a fresh OAuth transaction. If the browser still cannot retain the session, the second callback stops with a clearer error instead of looping.
What this changes
Developer impact
Includes a patch changeset for
@shopify/hydrogen. There are no new exports or public API changes.UX impact
Customers moving from an in-app browser to Safari or Chrome, and customers using multiple login tabs, can complete login automatically instead of seeing an Unauthorized response.
Risk
customerAccount.login(), matching the standard Hydrogen route.How to Test
pnpm --filter skeleton dev -- --customer-account-pushwith an account-enabled test shop.Bad request: Unauthorized.