From dfe064f90284661070790a7f93d3f84c5104fa36 Mon Sep 17 00:00:00 2001
From: Livio Spring <livio.a@gmail.com>
Date: Tue, 9 Dec 2025 13:37:26 +0100
Subject: [PATCH] fix(login): fix back button on 2fa screen to allow username
 change (#11125)

# Which Problems Are Solved

As reported to support, the back button on the various 2FA pages in
login V1 opened the default redirect URI, which likely started a new
auth request (e.g. from Console).

# How the Problems Are Solved

Change the back buttons to navigate to the login screen again, where a
user can change the username.
Additionally, the back button has been added to the U2F verification
screen.

# Additional Changes

None

# Additional Context

- from support
- backport to v4
---
 .../api/ui/login/static/templates/mfa_verification_u2f.html   | 4 ++++
 internal/api/ui/login/static/templates/mfa_verify_otp.html    | 2 +-
 internal/api/ui/login/static/templates/mfa_verify_totp.html   | 2 +-
 3 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/internal/api/ui/login/static/templates/mfa_verification_u2f.html b/internal/api/ui/login/static/templates/mfa_verification_u2f.html
index b020ae935..e2353c4b5 100644
--- a/internal/api/ui/login/static/templates/mfa_verification_u2f.html
+++ b/internal/api/ui/login/static/templates/mfa_verification_u2f.html
@@ -26,6 +26,10 @@
     {{ template "error-message" .}}
 
     <div class="lgn-actions" id="webauthn">
+        <!-- position element in header -->
+        <a class="lgn-icon-button lgn-left-action" href="{{ loginNameChangeUrl .AuthReqID }}">
+            <i class="lgn-icon-arrow-left-solid"></i>
+        </a>
         <span class="fill-space"></span>
         <a id="btn-login" class="lgn-raised-button lgn-primary wa-support">{{t "VerifyMFAU2F.ValidateTokenButtonText"}}</a>
     </div>
diff --git a/internal/api/ui/login/static/templates/mfa_verify_otp.html b/internal/api/ui/login/static/templates/mfa_verify_otp.html
index 95046ba45..4050e1623 100644
--- a/internal/api/ui/login/static/templates/mfa_verify_otp.html
+++ b/internal/api/ui/login/static/templates/mfa_verify_otp.html
@@ -24,7 +24,7 @@
 
     <div class="lgn-actions lgn-reverse-order">
         <!-- position element in header -->
-        <a class="lgn-icon-button lgn-left-action" href="{{ loginUrl }}">
+        <a class="lgn-icon-button lgn-left-action" href="{{ loginNameChangeUrl .AuthReqID }}">
             <i class="lgn-icon-arrow-left-solid"></i>
         </a>
         <button class="lgn-raised-button lgn-primary" id="submit-button" type="submit">{{t "VerifyOTP.NextButtonText"}}</button>
diff --git a/internal/api/ui/login/static/templates/mfa_verify_totp.html b/internal/api/ui/login/static/templates/mfa_verify_totp.html
index 345391660..163842c5f 100644
--- a/internal/api/ui/login/static/templates/mfa_verify_totp.html
+++ b/internal/api/ui/login/static/templates/mfa_verify_totp.html
@@ -24,7 +24,7 @@
 
     <div class="lgn-actions">
         <!-- position element in header -->
-        <a class="lgn-icon-button lgn-left-action" href="{{ loginUrl }}">
+        <a class="lgn-icon-button lgn-left-action" href="{{ loginNameChangeUrl .AuthReqID }}">
             <i class="lgn-icon-arrow-left-solid"></i>
         </a>
         <span class="fill-space"></span>