Skip to content

Fix duplicate OAuth code exchange causing invalid_grant crashes (MAILSPRING-CLIENT-37) #2792

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
bengotow wants to merge 2 commits into
base: master
Choose a base branch
from
+15 −1
Open

Fix duplicate OAuth code exchange causing invalid_grant crashes (MAILSPRING-CLIENT-37) #2792

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b355ea9
Guard against duplicate OAuth code exchange in oauth-signin-page (MAI…
claude Aug 12, 2026
bf998bc
Only dedupe identical OAuth codes, not all codes after the first
claude Aug 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 15 additions & 1 deletion app/internal_packages/onboarding/lib/oauth-signin-page.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,6 +55,7 @@ export default class OAuthSignInPage extends React.Component<
_startTimer: NodeJS.Timeout;
_warnTimer: NodeJS.Timeout;
_mounted = false;
_lastCodeReceived: string | null = null;

state: OAuthSignInPageState = {
authStage: 'initial',
Expand All @@ -79,7 +80,20 @@ export default class OAuthSignInPage extends React.Component<
if (!this._mounted) return;
const code = extractOAuthCodeFromUrl(request.url);
if (code) {
this._onReceivedCode(code);
// Browsers, security software, and link-preview tools can hit this URL more
// than once for the *same* code (retries, prefetching, back/forward replay).
// Authorization codes are single-use, so re-submitting an identical code just
// fails with an "invalid_grant" error from the provider — ignore repeats of a
// code we've already started exchanging. But the user can also legitimately
// go back in their browser and complete sign-in again with a different
// account, producing a genuinely new code; only ignore that if we're already
// mid-exchange (or have already succeeded) for the previous one.
const isNewCode = code !== this._lastCodeReceived;
const isBusy = this.state.authStage === 'buildingAccount' || this.state.authStage === 'accountSuccess';
if (isNewCode && !isBusy) {
this._lastCodeReceived = code;
this._onReceivedCode(code);
}
response.writeHead(302, { Location: 'https://id.getmailspring.com/oauth/finished' });
response.end();
} else {
Expand Down
Loading