Skip to content

fix(ui): remove back button from sign-in password compromised/pwned error screen#8280

Open
Ephem wants to merge 3 commits intomainfrom
fredrik/sdk-44-breached-password-error-allows-resubmission-via-back-button
Open

fix(ui): remove back button from sign-in password compromised/pwned error screen#8280
Ephem wants to merge 3 commits intomainfrom
fredrik/sdk-44-breached-password-error-allows-resubmission-via-back-button

Conversation

@Ephem
Copy link
Copy Markdown
Member

@Ephem Ephem commented Apr 9, 2026

Description

These errors are not recoverable by re-entering the password, so the back button led to a confusing dead end that would always take you back to the same error.

Before:

CleanShot 2026-04-09 at 16 24 16

After:

CleanShot 2026-04-09 at 16 23 32

Checklist

  • pnpm test runs as expected.
  • pnpm build runs as expected.
  • (If applicable) JSDoc comments have been added or updated for any package exports
  • (If applicable) Documentation has been updated

Type of change

  • 🐛 Bug fix
  • 🌟 New feature
  • 🔨 Breaking change
  • 📖 Refactoring / dependency upgrade / documentation
  • other:

Ephem added 2 commits April 9, 2026 16:02
This would take you back to re-enter the password, which never works so it was leading to a confusing dead end.
@changeset-bot
Copy link
Copy Markdown

changeset-bot bot commented Apr 9, 2026

🦋 Changeset detected

Latest commit: 18269d6

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages
Name Type
@clerk/ui Patch
@clerk/chrome-extension Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@github-actions github-actions bot added the ui label Apr 9, 2026
@vercel
Copy link
Copy Markdown

vercel bot commented Apr 9, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
clerk-js-sandbox Ready Ready Preview, Comment Apr 9, 2026 2:23pm

Request Review

@pkg-pr-new
Copy link
Copy Markdown

pkg-pr-new bot commented Apr 9, 2026

Open in StackBlitz

@clerk/agent-toolkit

npm i https://pkg.pr.new/@clerk/agent-toolkit@8280

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@8280

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@8280

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@8280

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@8280

@clerk/dev-cli

npm i https://pkg.pr.new/@clerk/dev-cli@8280

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@8280

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@8280

@clerk/express

npm i https://pkg.pr.new/@clerk/express@8280

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@8280

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@8280

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@8280

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@8280

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@8280

@clerk/react

npm i https://pkg.pr.new/@clerk/react@8280

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@8280

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@8280

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@8280

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@8280

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@8280

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@8280

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@8280

commit: 18269d6

@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai bot commented Apr 9, 2026

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: 46e651b2-ee3b-43b2-b3ed-0a8454ff3b30

📥 Commits

Reviewing files that changed from the base of the PR and between 3a2b08b and 18269d6.

📒 Files selected for processing (1)
  • packages/ui/src/components/SignIn/__tests__/SignInFactorOne.test.tsx
💤 Files with no reviewable changes (1)
  • packages/ui/src/components/SignIn/tests/SignInFactorOne.test.tsx

📝 Walkthrough

Walkthrough

This PR adds a Changeset for a patch release and updates the sign-in flow in the @clerk/ui package. It changes the canGoBack computation in SignInFactorOne.tsx to require both factorHasLocalStrategy(currentFactor) and the absence of passwordErrorCode, preventing the back action when a password error is present. A test covering the pwned/password-compromised back-navigation flow was removed.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (2 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly and concisely summarizes the main change: removing the back button from the password compromised/pwned error screen, which matches the primary objective across all modified files.
Description check ✅ Passed The description is directly related to the changeset, explaining the rationale for removing the back button and providing before/after screenshots demonstrating the UI change.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

Warning

Review ran into problems

🔥 Problems

Git: Failed to clone repository. Please run the @coderabbitai full review command to re-trigger a full review. If the issue persists, set path_filters to include or exclude specific files.


Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
packages/ui/src/components/SignIn/SignInFactorOne.tsx (1)

158-173: ⚠️ Potential issue | 🟠 Major

Update/remove the test case that expects back navigation during pwned/compromised password flows.

The code change prevents back navigation when passwordErrorCode is present (line 159: const canGoBack = factorHasLocalStrategy(currentFactor) && !passwordErrorCode;). However, the test at line 306 in SignInFactorOne.test.tsx ("entering a pwned password, then going back and clicking forgot password should result in the correct title") explicitly clicks the Back button during a pwned password scenario where passwordErrorCode will be set to 'pwned'. This test will fail because the Back button will no longer be clickable. Either remove this test or update it to validate that back navigation is intentionally disabled in error states.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@packages/ui/src/components/SignIn/SignInFactorOne.tsx` around lines 158 -
173, The test expecting back navigation during a pwned/compromised password flow
must be updated because SignInFactorOne now sets canGoBack =
factorHasLocalStrategy(currentFactor) && !passwordErrorCode, which disables the
Back button when passwordErrorCode (e.g., 'pwned') is present; modify the test
"entering a pwned password, then going back and clicking forgot password should
result in the correct title" in SignInFactorOne.test.tsx to either remove the
Back click or assert that the backHandler is not invoked / the Back button is
not rendered/clickable (inspect canGoBack/AlternativeMethods props or presence
of onBackLinkClick) so the test reflects the new behavior. Ensure references to
canGoBack, passwordErrorCode, backHandler, and the AlternativeMethods
onBackLinkClick prop are used to drive the updated assertions.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Outside diff comments:
In `@packages/ui/src/components/SignIn/SignInFactorOne.tsx`:
- Around line 158-173: The test expecting back navigation during a
pwned/compromised password flow must be updated because SignInFactorOne now sets
canGoBack = factorHasLocalStrategy(currentFactor) && !passwordErrorCode, which
disables the Back button when passwordErrorCode (e.g., 'pwned') is present;
modify the test "entering a pwned password, then going back and clicking forgot
password should result in the correct title" in SignInFactorOne.test.tsx to
either remove the Back click or assert that the backHandler is not invoked / the
Back button is not rendered/clickable (inspect canGoBack/AlternativeMethods
props or presence of onBackLinkClick) so the test reflects the new behavior.
Ensure references to canGoBack, passwordErrorCode, backHandler, and the
AlternativeMethods onBackLinkClick prop are used to drive the updated
assertions.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: 1d132934-db90-44cb-b82d-11c32b6ab187

📥 Commits

Reviewing files that changed from the base of the PR and between fef9b68 and 3a2b08b.

📒 Files selected for processing (2)
  • .changeset/pink-taxes-do.md
  • packages/ui/src/components/SignIn/SignInFactorOne.tsx

if (showAllStrategies || showForgotPasswordStrategies) {
const canGoBack = factorHasLocalStrategy(currentFactor);
// Password errors are not recoverable by re-entering the password, so we hide the back button
const canGoBack = factorHasLocalStrategy(currentFactor) && !passwordErrorCode;
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

passwordErrorCode is to me not a very clear name for this flag (it sounds more general than it is) but I confirmed that it is just a union of 'compromised' | 'pwned' so it's exactly what we want to check.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants