Being asked to log-in twice

[some-unprofessional-account]

Hello,

I followed the steps exactly as mentioned (clone the repo, configure Azure variables) but I have a hard time make it work properly when logging-in as different users concurrently.

I did the following:

1. Started the Flask application
2. Loaded the web page which redirected me to login.microsoftonline.com
3. I deleted all the cookies for Microsoft website to have a clean slate
4. Entered my credentials.
5. It got accepted but instead of logging-in, it redirected me to the credential entering page again. This time, under my username it I am already logged-in! I click on enter and log-in again.
6. I enter the website.

Why is it like that? Why do I sometimes have to log-in twice? This happens even if I do not delete Microsoft's cookies.

Another issue is that , if I open an incognito tab and go to the website, I am not logged-in anymore, as expected, so far so good. When I try to log-in using another user, I have to enter my credentials twice again, same issue as before. However, the new issue is that upon entering the website, the first user gets logged in instead of the one I just entered!

In short, I do not know what is going on with regards to cookies of my website vs. those of login.microsoftonline.com.

[rayluo]

Were you testing locally? If so, what redirect_uri did you register with your web app? It shall typically be http://localhost:some_port/some_path (rather than http://127.0.0.1/...), and then you need to make sure your local test also started from http://localhost:some_port rather than http://127.0.0.1:some_port. At least you shall double check and rule out that reason first.

[some-unprofessional-account]

It worked! Thanks. I was using http://127.0.0.1/ locally. I thought things like that would make the whole authentication system to not work instead of it half-working.

[rayluo]

It is "half-working" because you successfully signed in to 127.0.0.1 in your first attempt but then, upon the final redirect, you were redirected to localhost which is a host that you have not signed in with.

Yeah, I know, this has become a pet peeve for years. :-/