Files
zitadel/apps/login
Max PeintnerandGitHub 17f49323dd fix(login): preserve OIDC request context during email verification (#11990)
# Which Problems Are Solved

When a user needed to verify their email during an OIDC login flow, the
requestId was lost, preventing the flow from completing with a redirect
back to the relying party.

# How the Problems Are Solved

In `sendVerification()`, the session cookie lookup used `"loginName" in
command` to decide whether to fall back to `user.preferredLoginName`.
Since the `loginName` property key always exists in the command object
(even when its value is undefined), the fallback was never triggered.
This caused the lookup to search for loginName === undefined, finding no
session — and ultimately redirecting to a dead-end success page.

- /authenticator/set redirect: Added missing requestId to the URL params
when redirecting users who need to set up a primary auth method.
- /verify/success page: Added a "Continue" button that re-enters the
login flow with requestId preserved, handling the edge case where no
session cookie exists (e.g. email link opened in a different browser).
2026-04-08 10:25:43 +02:00
..
2025-10-08 10:27:02 +02:00
2026-04-02 15:53:08 +02:00
2026-04-07 14:14:12 +02:00
2026-04-02 15:53:08 +02:00
2026-04-02 15:53:08 +02:00
2026-04-02 15:53:08 +02:00