Asked to login account twice when prompt=login.

[jlin]

It is something quite strange to me, I am implementing the authorziation code grant flow with prompt=login in the first step. As expect, Fitbit prompts me for authentication. but sometimes (not very often), Fitbit will ask me to input the email/password twice, for the first try, after refresh the web page, a green notice bar will be popped up and say "You have logged out successfully." I am pretty sure that I have typed in the email/password right, and multiple people in my company have encountered this issue. May I ask why this is happening?

[JeremiahFitbit]

Can you please share the full URLs in the address bar when this happens?

[Chetan]

Finally got one case:

https://www.fitbit.com/login?redirect=%2Foauth2%2Fauthorize%3Fclient_id%3D228R6N%26response_type%3Dc...

After put in the password and username, it will redirect me to

https://www.fitbit.com/logout?redirect=%2Foauth2%2Fauthorize%3Fclient_id%3D228R6N%26response_type%3D...

[ThatOneCat]

We have experienced this as well. I have also heard from a user that they tried 20 times and never got it to login.

[JeremiahFitbit]

Thanks for the reports. We haven't been able to reproduce yet, but are tracking this issue.

[elamigo]

Hello,

I`m experiencing this issue as well.

The scenario to reproduce this behavior for me is the following:

1. Make sure you are logged out of fitbit.com with the account used for login

2. Authenticate with OAuth 2.0 with prompt = login

3.Voila

What happens next is, user gets redirected to https://www.fitbit.com/login?...

Then provides credentials and gets redirected to https://www.fitbit.com/logout?...

Provides credentials again and then is succesfully logged in.

If user is already logged in on fitbit.com when starting login procedure, then he/she is redirected directly to https://www.fitbit.com/logout?... and the problem does not occur.

Regards
Krzysztof

[Jaiyo]

Was this ever fixed?

[JeremiahFitbit]

@Jaiyo: The issue seemed to be that apps that were forcing login were not specifying a redirect_uri, as it is optional when there is only one redirect URI registered.

The fix is to specify your redirect_uri on the authorization page URL if you also want to force login.

[jlin]

Hi Jeremiah, I am pretty sure that specify the redirect_uri is not the fix, as we have specified that uri but the problem is still there.

[Jaiyo]

Any news on a fix?

[JeremiahFitbit]

We have been able to reproduce the issue, even when redirect_uri is specified. I do not yet have an estimate to share for when it will be fixed.

[ThatOneCat]

Just checking in to see if this is fixed. Thanks

[JeremiahFitbit · Accepted solution]

The issue has been fixed.