Email validation for new account logs me out of my account

[kittykat]

Steps to reproduce

1. Be logged into Element with an account
2. In the same browser, click on a validation link for a new Matrix account
3. Be logged out of your old account and logged into the new one

Outcome

What did you expect?

If I am already logged in, I would expect to not be logged out as that could cause me to lose my keys

What happened instead?

I was logged out and temporarily lost access to my historical messages

Operating system

No response

Browser information

Chromium 101.0.4951.64 (Official Build) Arch Linux (64-bit)

URL for webapp

develop.element.io

Application version

No response

Homeserver

No response

Will you send logs?

No

[germain-gg]

@kittykat this is marked as a regression, is that how this used to work?

This issue would benefit from being open on Synapse as this is the piece of the stack that issues those emails and the access token when clicking the link
Will close the ticket here as I am not able to move the issue cross organisations

[turt2live]

@gsouquet this works on app but not staging or develop - considering it a release blocker.

(we also have a code flow that is specifically meant to prevent this from happening on the client side)

[turt2live]

This appears to have regressed by matrix-org/matrix-react-sdk#8654 - we have the code here to prevent the overwrite, but the PR seems to bypass this.

Keeping as a release blocker, but not necessarily for the current RC->release cycle. This is something which needs to be fixed soon, I think, given it's been an issue for a couple months and release blockers are the current way of making that happen (unless there's a different process?)

[turt2live]

critical because it overwrites your account with no warning, causing data loss.