[CP Staging] [Payment due @huult] Coalesce concurrent SAML reauthentication redirects to fix SSO sign-in flashing by allgandalf · Pull Request #96108 · Expensify/App

allgandalf · 2026-07-14T18:00:16Z

Explanation of Change

SSO users on a SAML-required domain are sent back to their identity provider when their session token expires. The bug is that the sign-in page flashes and the SSO prompt fires several times in a row instead of once.

When the token expires the app sends a burst of requests at the same time (reconnectApp, openApp, AuthenticatePusher and so on) and they all come back 407 in the same tick. In reauthenticate() a SAML-required account cannot silently reauthenticate because there is no stored password, so every one of those 407s takes the account.isSAMLRequired branch and calls redirectToSignIn() on its own. Each call clears the session and re-mounts the sign-in page, and each mount re-initiates SAML, so the user sees the screen flash and the IdP prompt open several times.

Production logs from an affected account (anonymized) show the pattern. On reconnect, three commands hit the expired token and 407 inside the same half second:

15:14:32.979  ReconnectApp        ->  407 Unauthorized - Invalid token   (AuthTokenExpired: "Your session has expired")
15:14:33.368  OpenApp             ->  407 Unauthorized - Invalid token   (AuthTokenExpired)
15:14:33.523  AuthenticatePusher  ->  407 Unauthorized - Invalid token   (AuthTokenExpired)

Each of those 407s then drives its own reauthenticate() -> redirectToSignIn(), firing in the same instant (this is the flash):

12:20:59.258  [info] [Reauthenticate] Redirecting to Sign In because SAML is required
12:20:59.375  [info] [Reauthenticate] Redirecting to Sign In because SAML is required
12:20:59.376  [info] [Reauthenticate] Redirecting to Sign In because SAML is required

This coalesces those redirects. The first expired request in a burst queues the redirect and the rest are skipped, until the next SAML sign-in begins. The reset is keyed on the existing RAM_ONLY_IS_AUTHENTICATING_WITH_SHORT_LIVED_TOKEN flag, which flips on when a new short-lived-token exchange starts, so a later token expiry is still allowed to redirect. The result is one clean redirect and one SSO prompt per expiry instead of a flashing burst.

This does not change the redirect behaviour for non-SAML accounts, and it does not change how often a session expires.

Fixed Issues

$ https://github.com/Expensify/Expensify/issues/659015
PROPOSAL: N/A (internal fix)

Tests

On the native app, sign in as a user whose domain has SAML/SSO set to required.
Use the app until the session auth token expires, or force the next reconnect to receive a 407.
Bring the app back to the foreground so it reconnects.
Verify you are sent to the SSO sign-in once, with a single IdP prompt and no repeated screen flashing.
Complete SSO and verify you land back in the app signed in.
Let the new session expire and repeat, and verify each expiry produces a single prompt rather than a burst.

Verify that no errors appear in the JS console

Offline tests

SAML sign-in needs a network connection. While offline the requests never reach the server, so no 407 and no reauthentication redirect is triggered. There is no offline-specific behaviour for this change.

QA Steps

Same as the Tests section above. Requires a test account on a domain with SAML/SSO set to required, since the flow cannot be reproduced without one.

Verify that no errors appear in the JS console

PR Author Checklist

…n-in redirect

melvin-bot · 2026-07-14T18:00:22Z

@eh2077 Please copy/paste the Reviewer Checklist from here into a new comment on this PR and complete it. If you have the K2 extension, you can simply click: [this button]

mountiny · 2026-07-14T21:09:10Z

@huult can you please test this thoroughly?

huult · 2026-07-14T23:42:46Z

we need to release it to production to test. Could you help me after I've reviewed the code quality?

huult · 2026-07-14T23:55:14Z

@codex review

chatgpt-codex-connector · 2026-07-14T23:55:25Z

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

huult · 2026-07-15T00:03:08Z

Reviewer Checklist

I have verified the author checklist is complete (all boxes are checked off).
I verified the correct issue is linked in the ### Fixed Issues section above
I verified testing steps are clear and they cover the changes made in this PR
- I verified the steps for local testing are in the Tests section
- I verified the steps for Staging and/or Production testing are in the QA steps section
- I verified the steps cover any possible failure scenarios (i.e. verify an input displays the correct error message if the entered data is not correct)
- I turned off my network connection and tested it while offline to ensure it matches the expected behavior (i.e. verify the default avatar icon is displayed if app is offline)
I checked that screenshots or videos are included for tests on all platforms
I included screenshots or videos for tests on all platforms
I verified that the composer does not automatically focus or open the keyboard on mobile unless explicitly intended. This includes checking that returning the app from the background does not unexpectedly open the keyboard.
I verified tests pass on all platforms & I tested again on:
- Android: HybridApp
- Android: mWeb Chrome
- iOS: HybridApp
- iOS: mWeb Safari
- MacOS: Chrome / Safari
If there are any errors in the console that are unrelated to this PR, I either fixed them (preferred) or linked to where I reported them in Slack
I verified proper code patterns were followed (see Reviewing the code)
- I verified that comments were added to code that is not self explanatory
- I verified that any new or modified comments were clear, correct English, and explained "why" the code was doing something instead of only explaining "what" the code was doing.
- I verified any copy / text that was added to the app is grammatically correct in English. It adheres to proper capitalization guidelines (note: only the first word of header/labels should be capitalized), and is either coming verbatim from figma or has been approved by marketing (in order to get marketing approval, ask the Bug Zero team member to add the Waiting for copy label to the issue)
If a new code pattern is added I verified it was agreed to be used by multiple Expensify engineers
I verified that this PR follows the guidelines as stated in the Review Guidelines
I verified other components that can be impacted by these changes have been tested, and I retested again (i.e. if the PR modifies a shared library or component like Avatar, I verified the components using Avatar have been tested & I retested again)
If a new component is created I verified that:
- A similar component doesn't exist in the codebase
- All props are defined accurately
- The component has a clear name that is non-ambiguous and the purpose of the component can be inferred from the name alone
- The only data being stored in the state is data necessary for rendering and nothing else
- The component has the minimum amount of code necessary for its purpose, and it is broken down into smaller components in order to separate concerns and functions
If a new CSS style is added I verified that:
- A similar style doesn't already exist
- The style can't be created with an existing StyleUtils function (i.e. StyleUtils.getBackgroundAndBorderStyle(theme.componentBG)
If the PR modifies code that runs when editing or sending messages, I tested and verified there is no unexpected behavior for all supported markdown - URLs, single line code, code blocks, quotes, headings, bold, strikethrough, and italic.
If the PR modifies a generic component, I tested and verified that those changes do not break usages of that component in the rest of the App (i.e. if a shared library or component like Avatar is modified, I verified that Avatar is working as expected in all cases)
If the PR modifies a component related to any of the existing Storybook stories, I tested and verified all stories for that component are still working as expected.
If the PR modifies a component or page that can be accessed by a direct deeplink, I verified that the code functions as expected when the deeplink is used - from a logged in and logged out account.
If the PR modifies the UI (e.g. new buttons, new UI components, changing the padding/spacing/sizing, moving components, etc) or modifies the form input styles:
- I verified that all the inputs inside a form are aligned with each other.
- I added Design label and/or tagged @Expensify/design so the design team can review the changes.
For any bug fix or new feature in this PR, I verified that sufficient unit tests are included to prevent regressions in this flow.
If the main branch was merged into this PR after a review, I tested again and verified the outcome was still expected according to the Test steps.
I have checked off every checkbox in the PR reviewer checklist, including those that don't apply to this PR.

Screenshots/Videos

Android: HybridApp

Android: mWeb Chrome

iOS: HybridApp

iOS: mWeb Safari

MacOS: Chrome / Safari

huult

LGTM.

melvin-bot · 2026-07-15T00:08:06Z

🎯 @huult, thanks for reviewing and testing this PR! 🎉

A payment issue will be created for your review once this PR is deployed to production.
E/E issue linked to the PR - https://www.github.com/Expensify/Expensify/issues/659015.

If payment is not needed (e.g., regression PR review fix etc), react with 👎 to this comment to prevent the payment issue from being created.

huult · 2026-07-15T00:09:01Z

@mountiny We need to cherry-pick this to production for manual testing. Please let me know when it's ready in prod, and I will test it.

github-actions · 2026-07-15T09:53:04Z

🚧 mountiny has triggered a test Expensify/App build. You can view the workflow run here.

github-actions · 2026-07-15T09:58:31Z

🧪🧪 Use the links below to test this adhoc build on Android, iOS, and Web. Happy testing! 🧪🧪
Built from App PR #96108.

Android 🤖	iOS 🍎
https://ad-hoc-expensify-cash.s3.us-east-1.amazonaws.com/rock-artifacts/ad-hoc/rock-android-Adhoc-fa0cefa5af3-cc9a105-601a7cfc6924b7d0b01e1c15562bc3215562d9eb/index.html	https://ad-hoc-expensify-cash.s3.us-east-1.amazonaws.com/rock-artifacts/ad-hoc/rock-ios-device-AdHoc-fa0cefa-cc9a105-13065c00ddcca7483980edbecd48f505b76cd8ee/index.html

Web 🕸️
https://96108.pr-testing.expensify.com

👀 View the workflow run that generated this build 👀

OSBotify · 2026-07-15T09:59:27Z

✋ This PR was not deployed to staging yet because QA is ongoing. It will be automatically deployed to staging after the next production release.

…alesce (cherry picked from commit fa0cefa) (cherry-picked to staging by mountiny)

OSBotify · 2026-07-15T11:37:25Z

🚀 Cherry-picked to staging by https://github.com/mountiny in version: 9.4.34-10 🚀

platform	result
🕸 web 🕸	success ✅
🤖 android 🤖	success ✅
🍎 iOS 🍎	success ✅

MelvinBot · 2026-07-15T11:39:14Z

🤖 I reviewed the changes in this PR against the help site files under App/docs/articles.

No help site changes are required. This is an internal bug fix — it coalesces the burst of concurrent SAML reauthenticate() → redirectToSignIn() calls so that an expired-session SSO user gets a single clean redirect and one IdP prompt instead of a flashing burst. The changes are confined to src/libs/Reauthentication.ts and a unit test.

Why no docs update is needed

The fix does not change any documented feature, setting, tab, button, or workflow. It only removes duplicated redirects during a session-expiry burst.
The relevant SSO help articles describe how to configure and troubleshoot SAML/SSO — none of them describe the flashing/multiple-prompt behavior this PR corrects, so there is nothing to add or amend:
- new-expensify/domains/Set-Up-SAML-SSO.md
- new-expensify/domains/Troubleshoot-SAML-SSO-Login.md
- expensify-classic/domains/Set-Up-SAML-SSO.md
- expensify-classic/domains/Troubleshoot-SAML-SSO-Login.md
The end-user-visible outcome (sign in via SSO when your session expires) is unchanged; only the buggy flashing is removed.

@allgandalf, since no help site changes are needed, no draft PR was created. If you believe a troubleshooting note should be added anyway (e.g., a line in the SAML/SSO troubleshooting article), let me know and I'll draft one.

m-natarajan · 2026-07-15T15:53:58Z

Unable to sign in when the required SAML turn on, Tested on Xiaomi Poco F5 / Android 13 in v9.4.34-10.

1000211853.mp4

In Desktop continuous loading displayed

Recording.3217.mp4

OSBotify · 2026-07-16T05:12:16Z

🚀 Cherry-picked to staging by https://github.com/mountiny in version: 9.4.34-14 🚀

platform	result
🕸 web 🕸	success ✅
🤖 android 🤖	cancelled 🔪
🍎 iOS 🍎	cancelled 🔪

MelvinBot · 2026-07-16T05:15:20Z

🤖 No help site changes required.

This PR is an internal bug fix in the auth/reauthentication layer — it coalesces the burst of concurrent SAML reauthentication redirects that fire when a session token expires, so an SSO user sees a single IdP prompt instead of a flashing series of redirects. It changes src/libs/Reauthentication.ts and its test; there are no user-facing feature, workflow, setting, label, or copy changes.

I reviewed the existing SAML/SSO help articles and none of them document the behavior this PR touches:

expensify-classic/domains/Set-Up-SAML-SSO.md
expensify-classic/domains/Troubleshoot-SAML-SSO-Login.md
new-expensify/settings/Login-Troubleshooting.md

These articles cover how to configure SAML SSO and how to troubleshoot login failures (certificates, IdP metadata, lockouts). The fix simply restores the intended single-redirect behavior on token expiry — it does not add, remove, or change any documented user-facing behavior — so there is nothing to update on the help site and no draft PR is needed.

@allgandalf, if you'd still like a docs PR created (e.g. you consider any of this worth documenting), let me know and I'll open one.

OSBotify · 2026-07-16T05:17:08Z

🚀 Deployed to production by https://github.com/roryabraham in version: 9.4.34-14 🚀

platform	result
🕸 web 🕸	success ✅
🤖 android 🤖	failure ❌
🍎 iOS 🍎	failure ❌

melvin-bot · 2026-07-16T05:18:44Z

🤖 Payment issue created: #96239

OSBotify · 2026-07-16T05:29:00Z

🚀 Cherry-picked to staging by https://github.com/mountiny in version: 9.4.34-14 🚀

platform	result
🕸 web 🕸	success ✅
🤖 android 🤖	success ✅
🍎 iOS 🍎	failure ❌

MelvinBot · 2026-07-16T05:30:19Z

🤖 No help site changes required.

This PR is an internal bug fix in the auth/reauthentication layer — it coalesces the burst of concurrent SAML reauthentication redirects that fire when a session token expires, so an SSO user sees a single IdP prompt instead of a flashing series of redirects. It only changes src/libs/Reauthentication.ts and its test; there are no user-facing feature, workflow, setting, label, or copy changes.

I reviewed the existing SAML/SSO help articles and none of them document the behavior this PR touches:

expensify-classic/domains/Set-Up-SAML-SSO.md
expensify-classic/domains/Troubleshoot-SAML-SSO-Login.md
new-expensify/settings/Login-Troubleshooting.md

These articles cover how to configure SAML SSO and how to troubleshoot login failures (certificates, IdP metadata, lockouts). The fix simply restores the intended single-redirect behavior on token expiry — it does not add, remove, or change any documented user-facing behavior — so there is nothing to update on the help site and no draft PR is needed.

@allgandalf, if you'd still like a docs PR created (e.g. you consider any of this worth documenting), let me know and I'll open one.

OSBotify · 2026-07-16T06:08:01Z

🚀 Deployed to production by https://github.com/roryabraham in version: 9.4.34-14 🚀

platform	result
🕸 web 🕸	success ✅
🤖 android 🤖	success ✅
🍎 iOS 🍎	success ✅

Bundle Size Analysis (Sentry):

Android

OSBotify · 2026-07-16T06:50:50Z

🚀 Cherry-picked to staging by https://github.com/mountiny in version: 9.4.35-1 🚀

platform	result
🕸 web 🕸	success ✅
🤖 android 🤖	success ✅
🍎 iOS 🍎	success ✅

MelvinBot · 2026-07-16T06:52:30Z

🤖 Re-checked — my conclusion is unchanged: no help site changes are required for this PR.

It's an internal fix in the auth/reauthentication layer (src/libs/Reauthentication.ts + its test) that coalesces the burst of concurrent SAML reauthentication redirects on token expiry, so an SSO user gets a single IdP prompt instead of a flashing series. There's no new or changed user-facing feature, workflow, setting, label, or copy, and the existing SAML/SSO articles (Set-Up-SAML-SSO.md, Troubleshoot-SAML-SSO-Login.md, Login-Troubleshooting.md) don't document the behavior this touches — so there's nothing to update and no draft PR to open.

(This matches the earlier reviews already posted on this PR.)

@allgandalf, if you'd still like a docs PR created for any part of this, let me know and I'll open one.

huult · 2026-07-16T11:10:43Z

@m-natarajan Could you try reproducing this issue on production #96108 (comment)

I haven't been able to reproduce it on production so far.

mountiny · 2026-07-16T11:13:31Z

I asked for a retest

OSBotify · 2026-07-16T23:52:15Z

🚀 Deployed to production by https://github.com/jasperhuangg in version: 9.4.35-6 🚀

platform	result
🕸 web 🕸	success ✅
🤖 android 🤖	success ✅
🍎 iOS 🍎	success ✅

allgandalf added 2 commits July 14, 2026 23:28

Coalesce concurrent SAML reauthentication redirects into a single sig…

314fb1e

…n-in redirect

Add tests for SAML reauthentication redirect coalescing

eac9ef3

allgandalf requested review from a team as code owners July 14, 2026 18:00

melvin-bot Bot requested review from eh2077 and trjExpensify and removed request for a team July 14, 2026 18:00

melvin-bot Bot removed the request for review from a team July 14, 2026 18:00

melvin-bot Bot assigned allgandalf Jul 14, 2026

allgandalf requested review from mountiny and removed request for eh2077 and trjExpensify July 14, 2026 18:01

mountiny requested a review from huult July 14, 2026 21:08

huult approved these changes Jul 15, 2026

View reviewed changes

melvin-bot Bot changed the title ~~Coalesce concurrent SAML reauthentication redirects to fix SSO sign-in flashing~~ [Payment due @huult] Coalesce concurrent SAML reauthentication redirects to fix SSO sign-in flashing Jul 15, 2026

mountiny approved these changes Jul 15, 2026

View reviewed changes

mountiny merged commit fa0cefa into Expensify:main Jul 15, 2026
38 of 40 checks passed

mountiny changed the title ~~[Payment due @huult] Coalesce concurrent SAML reauthentication redirects to fix SSO sign-in flashing~~ [CP Staging] [Payment due @huult] Coalesce concurrent SAML reauthentication redirects to fix SSO sign-in flashing Jul 15, 2026

OSBotify pushed a commit that referenced this pull request Jul 15, 2026

Merge pull request #96108 from allgandalf/fix-saml-reauth-redirect-co…

207d91c

…alesce (cherry picked from commit fa0cefa) (cherry-picked to staging by mountiny)

OSBotify added the CP Staging marks PRs that have been CP'd to staging label Jul 15, 2026

OSBotify mentioned this pull request Jul 15, 2026

Deploy Checklist: New Expensify 2026-07-14 #96044

Closed

melvin-bot Bot mentioned this pull request Jul 16, 2026

[Due for payment 2026-07-23] Payment issue for E/App PR#96108 #96239

Open

Uh oh!

Conversation

allgandalf commented Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Explanation of Change

Fixed Issues

Tests

Offline tests

QA Steps

PR Author Checklist

Uh oh!

melvin-bot Bot commented Jul 14, 2026

Uh oh!

mountiny commented Jul 14, 2026

Uh oh!

huult commented Jul 14, 2026

Uh oh!

huult commented Jul 14, 2026

Uh oh!

chatgpt-codex-connector Bot commented Jul 14, 2026

Uh oh!

huult commented Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviewer Checklist

Screenshots/Videos

Uh oh!

huult left a comment

Choose a reason for hiding this comment

Uh oh!

melvin-bot Bot commented Jul 15, 2026

Uh oh!

huult commented Jul 15, 2026

Uh oh!

Uh oh!

github-actions Bot commented Jul 15, 2026

Uh oh!

github-actions Bot commented Jul 15, 2026

Uh oh!

OSBotify commented Jul 15, 2026

Uh oh!

OSBotify commented Jul 15, 2026

Uh oh!

MelvinBot commented Jul 15, 2026

Uh oh!

m-natarajan commented Jul 15, 2026

Uh oh!

OSBotify commented Jul 16, 2026

Uh oh!

MelvinBot commented Jul 16, 2026

Uh oh!

OSBotify commented Jul 16, 2026

Uh oh!

melvin-bot Bot commented Jul 16, 2026

Uh oh!

OSBotify commented Jul 16, 2026

Uh oh!

MelvinBot commented Jul 16, 2026

Uh oh!

OSBotify commented Jul 16, 2026

Uh oh!

OSBotify commented Jul 16, 2026

Uh oh!

MelvinBot commented Jul 16, 2026

Uh oh!

huult commented Jul 16, 2026

Uh oh!

mountiny commented Jul 16, 2026

Uh oh!

OSBotify commented Jul 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

allgandalf commented Jul 14, 2026 •

edited

Loading

huult commented Jul 15, 2026 •

edited

Loading