<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br><div><div>On Apr 7, 2014, at 10:03 AM, Nick Alexander <<a href="mailto:nalexander@mozilla.com">nalexander@mozilla.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">Hi folks,<br><br>This is motivated by Bug 992390 [1], which is about adding client goo for the /account/status endpoint. (For the record, I don't see /account/status at [2], which means I'm guessing in several places.)<br><br></blockquote><div><br></div><div><a href="https://github.com/mozilla/fxa-auth-server/blob/master/docs/api.md#get-v1accountstatus">https://github.com/mozilla/fxa-auth-server/blob/master/docs/api.md#get-v1accountstatus</a></div><br><blockquote type="cite">On the ticket, ckarlof says, "This will allow us to detect when a user's account has been deleted and can remove her account previously attached to desktop browsers."<br><br>It seems like this is supposed to be used after a failed /account/login, that returns 400/102, "attempt to access an account that does not exist", provided that the client knows the account existed at some point.<br><br>What does the client produce to identify the account to /account/status? Clearly it's not the email address, 'cuz the email address could be re-used (and we wouldn't get 400/102 in this case, we'd get 401). I have a hard time believing it's the session token; are we really going to store session tokens on the backend forever?<br><br></blockquote><div><br></div><div>/account/status takes the uid as a parameter.</div><br><blockquote type="cite">So, who's going to straighten me out?<br><br></blockquote><div><br></div><div>Here's an example case:</div><div><br></div><div>1) A user has her desktop browser attached to FxA Sync </div><div>2) She goes to <a href="http://accounts.firefox.com">accounts.firefox.com</a> and deletes her FxA</div><div>3) She starts the desktop browser previously attached to FxA Sync</div><div><br></div><div>Actual: /certificate/sign fails with 401/110 and the browser enters the "half-logged in, need to re-enter your password to reconnect state", which will now start returning 102s if she tries to re-authenticate. </div><div>Expected: The desktop browser automatically disconnects from FxA Sync and reverts to the logged out state.</div><div><br></div><div>When the browser gets a 401/110 from /certificate/sign, it would query /account/status to see if the account is still active. If it is, the browser moves to the "reconnect to sync" state which prompts the user to log back in. If the account doesn't exist, then the browser can detach the dead account.</div><div><br></div><div>-chris</div><div><br></div><br><blockquote type="cite">Yours,<br>Nick<br><br>[1] <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=992390">https://bugzilla.mozilla.org/show_bug.cgi?id=992390</a><br><br>[2] <a href="https://github.com/mozilla/fxa-auth-server/wiki/onepw-protocol">https://github.com/mozilla/fxa-auth-server/wiki/onepw-protocol</a><br>_______________________________________________<br>Dev-fxacct mailing list<br><a href="mailto:Dev-fxacct@mozilla.org">Dev-fxacct@mozilla.org</a><br>https://mail.mozilla.org/listinfo/dev-fxacct<br></blockquote></div><br></body></html>