search

mikker / passwordless

🗝 Authentication for your Rails app without the icky-ness of passwords
MIT License
1.26k stars 85 forks source link

Should Passwordless disallow visiting /sign_in if signed in already? #150

Closed ravinhwg closed 11 months ago

ravinhwg commented 1 year ago

Hi, I'm new to rails development. I've tried to find a solution to the above problem but have not been able to solve it so far.

Steps to reproduce,

  1. Create new user
  2. Send magic link
  3. Sign in

Signed in user can still visit the login page. What is the correct way to stop it? I got a bit wacky and implemented a logic where it prevents rendering the form in the view but there must be a proper way.

thank you in advance.

mikker commented 1 year ago

I think I remember this has been brought up before. Why do you think it's a problem that a signed in user can visit the sign-in page?

ravinhwg commented 1 year ago

Hi Mikkel,

first of, thank you very much for giving your attention to this issue. So to answer your question I think if we go with the standards it is an intuitive choice to prevent the user from navigating to auth routes other than the /sign_out. I mean it's a behaviour enforced in almost all websites.

mikker commented 1 year ago

🤷‍♂️ I don't know, I don't think it's a problem. Intuitive and common aren't really saying anything about whether it's a good idea or not. If others feel it's a problem as well, feel free to jump in.