Login - After refreshing "Enter 2FA code" page Sign in page with empty input appears

[jponikarchuk]

If you haven’t already, check out our contributing guidelines for onboarding and email contributors@expensify.com to request to join our Slack channel!

---

Version Number: 9.3.20-1
Reproducible in staging?: Yes
Reproducible in production?: Yes
If this was caught during regression testing, add the test name, ID and link from BrowserStack: https://test-management.browserstack.com/projects/2219752/folder/13176924/test-cases/41237550
Email or phone of affected tester (no customers): applausetester+ii_29012@applause.expensifail.com
Issue reported by: Applause Internal Team
Bug source: Regression TC Execution
Device used: iPhone 15 iOS 26.2.1
App Component: Other

Action Performed:

Preconditions: enable 2FA for an expensifail account

1. Navigate https://staging.new.expensify.com/, in the email input enter an account from precondition
2. Enter the magic code
3. Refresh the "Enter the 2FA code" page

Expected Result:

The log in flow is still asking the user to enter the 2FA code (TC-4154 step 26, TC steps are simplified for easier reproduction)

Actual Result:

User is redirected to the first Sign in page again with an empty email input

Workaround:

Unknown

Platforms:

• Android: App
• Android: mWeb Chrome
• iOS: App
• iOS: mWeb Safari
• iOS: mWeb Chrome
• Windows: Chrome
• MacOS: Chrome / Safari

Screenshots/Videos

1.mp4

View all open jobs on GitHub

Issue Owner

Current Issue Owner: @iwiznia

[melvin-bot]

Triggered auto assignment to Contributor-plus team member for initial proposal review - @Ollyws (External)

[melvin-bot]

Triggered auto assignment to @mallenexpensify (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details. Please add this bug to a GH project, as outlined in the SO.

[melvin-bot]

Unable to auto-create job on Upwork. The BZ team member should create it manually for this issue.

[mohammadjafarinejad]

🚨 Edited by proposal-police: This proposal was edited at 2026-02-17 09:17:42 UTC.

Proposal

Please re-state the problem that we are trying to solve in this issue.

User is redirected to the first Sign in page again with an empty email input after refreshing the "Enter 2FA code" page.

What is the root cause of that problem?

After the app initializes, it calls openApp() which requires an authToken. Since 2FA hasn't been completed, reauthentication fails too because the user isn't authenticated. The failure calls redirectToSignIn().

The bug is in the clearStorageAndRedirect() function. When clearing Onyx storage, the preserve list doesn't include ONYXKEYS.CREDENTIALS or ONYXKEYS.ACCOUNT. This means credentials.login (user's email), credentials.validateCode (magic code), and account.requiresTwoFactorAuth flag all get cleared.

App/src/libs/actions/SignInRedirect.ts

Lines 31 to 36 in 2a23366

	function clearStorageAndRedirect(errorMessage?: string): Promise<void> {
	// Under certain conditions, there are key-values we'd like to keep in storage even when a user is logged out.
	// We pass these into the clear() method in order to avoid having to reset them on a delayed tick and getting
	// flashes of unwanted default state.
	const keysToPreserve: OnyxKey[] = [];
	keysToPreserve.push(ONYXKEYS.NVP_PREFERRED_LOCALE);

Basically, clearStorageAndRedirect() wasn't designed for incomplete sign-in flows where credentials should persist through a refresh.

What changes do you think we should make in order to solve the problem?

Update SignInRedirect.ts:

1. Add Onyx listeners to track session and credentials state:

let currentSession: {authToken?: string} | undefined;
let currentCredentials: {validateCode?: string} | undefined;

Onyx.connectWithoutView({
    key: ONYXKEYS.SESSION,
    callback: (value) => {
        currentSession = value;
    },
});

Onyx.connectWithoutView({
    key: ONYXKEYS.CREDENTIALS,
    callback: (value) => {
        currentCredentials = value;
    },
});

2. In clearStorageAndRedirect(), conditionally preserve credentials during incomplete sign-in:

const isIncompleteSignIn = !currentSession?.authToken && !!currentCredentials?.validateCode;
if (isIncompleteSignIn) {
    keysToPreserve.push(ONYXKEYS.CREDENTIALS);
    keysToPreserve.push(ONYXKEYS.ACCOUNT);
}

Logic:

• Preserve if: no authToken (not logged in) AND has validateCode (user entered code)
• Don't preserve if: has authToken (logged in user signing out)
• Don't preserve if: no validateCode (fresh sign-in attempt)

---

We could also add a timestamp check to avoid showing the 2FA page with an expired code after a long app closure

Step 3: Add codeTimestamp to the Credentials type:

// src/types/onyx/Credentials.ts
type Credentials = {
  // ... existing fields ...

  /** Timestamp when validateCode was set (for staleness detection) */
  codeTimestamp?: number;
};

Step 4: Set timestamp when storing validateCode:

// src/libs/actions/Session/index.ts
// In signIn() and other places where validateCode is set
Onyx.merge(ONYXKEYS.CREDENTIALS, {
  validateCode,
  codeTimestamp: Date.now(),
});

Result

REC-20260217124202.mp4

What alternative solutions did you explore? (Optional)

Approach A: Add parameter to redirectToSignIn():

function redirectToSignIn(errorMessage?: string, shouldPreserveSignInState = false)

Approach B: Fix app initialization to skip openApp() during incomplete sign-in:

App/src/Expensify.tsx

Lines 408 to 419 in cf58a4a

	useEffect(() => {
	if (hasHandledMissingIsLoadingAppRef.current || !isOnyxMigrated || !hasLoadedApp || isLoadingApp !== undefined || isOffline) {
	return;
	}
	hasHandledMissingIsLoadingAppRef.current = true;
	Log.info('[Onyx] isLoadingApp missing after app is ready', false, {
	sessionAccountID: session?.accountID,
	hasLoadedApp: !!hasLoadedApp,
	});
	confirmReadyToOpenApp();
	openApp();
	}, [hasLoadedApp, isLoadingApp, isOffline, isOnyxMigrated, session?.accountID]);

// ... existing initialization code ...

// Skip openApp() during incomplete sign-in to prevent reauthentication failure
const hasIncompleteSignIn = !session?.authToken && !!credentials?.validateCode;

if (hasIncompleteSignIn) {
  confirmReadyToOpenApp();
  // Don't call openApp() - let user complete 2FA flow
  return;
}

confirmReadyToOpenApp();
openApp();

[MelvinBot]

🔍 Issue Analysis

Summary: When a user refreshes the page (or restarts the app) while on the "Enter 2FA code" step of sign-in, they are redirected back to the initial sign-in page with an empty email input instead of remaining on the 2FA step.

Root Cause: The sign-in flow state (credentials.login, credentials.validateCode, account.requiresTwoFactorAuth) is stored in Onyx and persisted to disk. On a normal restart, Onyx's initializeWithDefaultKeyStates performs a merge (not replace), so requiresTwoFactorAuth and credentials should survive rehydration. However, the clearStorageAndRedirect() function in SignInRedirect.ts does not preserve ONYXKEYS.CREDENTIALS or ONYXKEYS.ACCOUNT in its keysToPreserve list — it only preserves UI preferences (locale, theme, device ID, etc.). If any API call triggers a redirectToSignIn() during app initialization, all sign-in state is wiped.

The specific trigger path: even though openApp() is not directly called during incomplete sign-in (it only runs inside AuthScreens, which requires authToken), there are other code paths that can trigger redirectToSignIn() — particularly the reauthentication middleware (Reauthentication.ts:39) when any API request gets a NOT_AUTHENTICATED response, and Authentication.ts when reauthentication fails with missing credentials.

Additionally, there is a notable commented-out check in Authentication.ts:133-140 where the redirect for missing autoGeneratedLogin/autoGeneratedPassword was disabled for investigation of a separate issue (#fireroom-2026-01-28-user-signout). With that guard disabled, reauthentication can proceed with empty credentials, fail at the server, and still ultimately call redirectToSignIn().

Recommended Fix: In clearStorageAndRedirect() (SignInRedirect.ts:31-78), conditionally preserve ONYXKEYS.CREDENTIALS and ONYXKEYS.ACCOUNT when the user is in an incomplete sign-in state (no authToken but has validateCode). This aligns with the approach in the existing proposal from @mohammadjafarinejad.

Evaluation of Existing Proposal

The proposal from @mohammadjafarinejad identifies the correct file (SignInRedirect.ts) and the correct function (clearStorageAndRedirect) as the fix location. The proposed approach of conditionally preserving CREDENTIALS and ACCOUNT when !currentSession?.authToken && !!currentCredentials?.validateCode is reasonable.

However, one correction to the proposal's root cause analysis: The proposal states that openApp() is called and triggers reauthentication failure. This is not accurate — openApp() only executes inside AuthScreens which requires authToken (see AuthScreens.tsx:255-283). Since there's no authToken during the 2FA step, AuthScreens never mounts and openApp() is never called. The actual trigger is more likely a background API call or network request that receives a NOT_AUTHENTICATED response, triggering the reauthentication middleware.

The proposed fix is in the right direction — preserving credentials during incomplete sign-in flows in clearStorageAndRedirect() would prevent the state loss regardless of what triggers redirectToSignIn().

Open Questions

• What exact API call triggers the reauthentication flow during the 2FA step? Production logs would help confirm the specific trigger.
• The timestamp/staleness check proposed (Steps 3-4) adds complexity — is there a simpler approach, like checking if the validateCode has expired via the server rather than client-side timestamps?
• Should the fix also handle the case where Onyx writes haven't been flushed to storage before a web page refresh (a potential race condition with IndexedDB)?

Detailed Investigation

Root Cause Analysis

The sign-in flow in the App uses a single SignInPage component that determines which sub-step to show based on Onyx state:

1. Email input: shown when !credentials?.login && !credentials?.validateCode (SignInPage.tsx:116)
2. Magic code input: shown when credentials.login exists and the validate code form conditions are met (SignInPage.tsx:120-128)
3. 2FA input: shown when account.requiresTwoFactorAuth && credentials.validateCode (BaseValidateCodeForm.tsx:312)

During the 2FA step, session.authToken does not exist — the server only issues it after successful 2FA completion. This means:

• useIsAuthenticated() returns false (useIsAuthenticated.tsx:7)
• AppNavigator renders PublicScreens (not AuthScreens) (AppNavigator.tsx:12-26)
• openApp() is never called (it only runs inside AuthScreens)

The state that controls the 2FA display (credentials.login, credentials.validateCode, account.requiresTwoFactorAuth) is persisted by Onyx to disk storage. On normal app restart, initializeWithDefaultKeyStates merges DEFAULT_ACCOUNT_DATA ({errors: null, success: '', isLoading: false}) with the persisted ACCOUNT data using fastMerge — this preserves requiresTwoFactorAuth because it's not in the default key states.

The bug occurs when redirectToSignIn() is triggered, which calls clearStorageAndRedirect() → Onyx.clear(keysToPreserve). The preserve list does NOT include CREDENTIALS or ACCOUNT, so both are wiped, and the sign-in page falls back to showing the email input form.

Evidence Chain

1. clearStorageAndRedirect() preserve list (SignInRedirect.ts:35-42): only NVP_PREFERRED_LOCALE, ARE_TRANSLATIONS_LOADING, PREFERRED_THEME, ACTIVE_CLIENTS, DEVICE_ID, SHOULD_USE_STAGING_SERVER, IS_DEBUG_MODE_ENABLED
2. redirectToSignIn() callers: Reauthentication.ts:39 (after retry exhaustion), Authentication.ts:75 (missing params), Authentication.ts:193 (non-200 auth response), Session/index.ts (various sign-out flows)
3. Commented-out credential check at Authentication.ts:133-140 allows reauthentication to proceed with empty credentials, which then fails
4. signIn() success data stores validateCode in credentials (Session/index.ts:824-832) — this is what enables the 2FA step display
5. useIsAuthenticated checks only session.authToken (useIsAuthenticated.tsx:7) — binary gate for Public vs Auth screens

Relevant Code

• App/src/libs/actions/SignInRedirect.ts:31-78 - clearStorageAndRedirect() with incomplete preserve list
• App/src/libs/Middleware/Reauthentication.ts:31-43 - Reauthentication retry with redirectToSignIn fallback
• App/src/libs/Authentication.ts:126-194 - Reauthenticate with commented-out credential check
• App/src/pages/signin/SignInPage.tsx:86-145 - getRenderOptions() decision logic
• App/src/pages/signin/ValidateCodeForm/BaseValidateCodeForm.tsx:312 - 2FA vs magic code conditional
• App/src/hooks/useIsAuthenticated.tsx:5-9 - Authentication gate
• App/src/libs/actions/App.ts:124-147 - Separate KEYS_TO_PRESERVE that DOES include CREDENTIALS/ACCOUNT (but not used by redirectToSignIn)

Implementation Notes

• The fix should add Onyx listeners for SESSION and CREDENTIALS in SignInRedirect.ts
• Conditionally preserve CREDENTIALS and ACCOUNT when !session.authToken && credentials.validateCode (incomplete sign-in)
• This does NOT affect normal sign-out flows where authToken exists
• Consider whether the KEYS_TO_PRESERVE in App.ts:124-147 could be shared/reused rather than creating duplicate preserve logic

---

Next Steps for Contributor+ team: Reply with @MelvinBot implement this to create a draft PR, or @MelvinBot <your feedback> to refine this analysis.