Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Account wizard: clicking "Open" while the browser is still starting creates a second Login Flow v2 that breaks the first one

Open Beginner friendly
  • Is something wrong?
#11,110 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
68/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
cpp
Domain
authentication, desktop

Research direction

Start with AccountWizardController::initialiseAccount, startLoginFlowAutomatically, and Flow2Auth::openBrowser() to trace how automatic and manual browser launches fetch login tokens. Check the account wizard button and status handling, then add protection against a second flow while the first browser launch is starting. Done means repeated clicks during startup do not create another login flow; verify the wizard still completes login.

Written by the indexing model from the issue text.

Description

Version: desktop client 35.0.0 (ce977e3, Launchpad PPA nextcloud-devs/client), Ubuntu 26.04, GNOME, Firefox. Server 34.0.4.

Steps

  1. Configure overrideServerUrl (e.g. nextcloud --overrideserverurl https://cloud.example). The account wizard then starts the login flow automatically (AccountWizardController::initialiseAccount → startLoginFlowAutomatically).
  2. The browser isn't running yet, so it takes a few seconds to appear. Meanwhile the wizard shows "Switch to your browser" with an "Open" button.
  3. Click "Open" during that window. It calls Flow2Auth::openBrowser() → fetchNewToken(): a second POST /index.php/login/v2 and a second xdg-open.

Result
The browser opens two tabs at once, sharing the session cookie. The server keeps a single login token and a single state token per session (ClientFlowLoginV2Controller::landing / showAuthPickerPage), so one tab gets "State token does not match" / 403. Depending on request order, the surviving tab may complete a flow the client no longer polls (the client only polls the newest token), and the account setup doesn't finish.

Expected
A second "Open" shortly after a token was fetched should not start a new flow until the first browser launch had a chance to show up. For example: disable the button for a few seconds after openBrowser, or show an "Opening your browser…" status.

Server access log (one attempt): one status.php / auth-type probe, then POST /index.php/login/v2 at t and t+2 s, two GET /login/v2/flow/<token> at t+4 s, and GET /login/v2/flow → 403 at t+6 s. The user confirmed they clicked "Open" once while waiting for the browser.

Dominant language
C++
Stars
3.9k
Forks
1k
Avg merge
18h 7m
Merged PRs (30d)
102

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from nextcloud/desktop

All issues in nextcloud/desktop

Similar issues

More C++ issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.