# Bug OP-16141 - Signing in after two factor methods have been deleted lead to a 500 error

Project: OpenProject
Status: closed
URL: https://community.openproject.org/work_packages/OP-16141

## Open points

_No work packages_

## Details

| Attribute | Value |
| --- | --- |
| Date |  |
| Priority | Low |
| Module |  |
| Target versions | 15.1.0 |
| Observed in versions | 15.0.0 |
| Sprint | 15.1.0 |
| Backlog bucket |  |
| Bug found in version (deprecated) | 15.0.x |
| Found in mobile app version |  |
| Follow-up feedback e-mail |  |
| Requires doc change | No |
| Accessibility | No |
| Pull preview |  |
| List |  |
| Labels |  |

## People

| Attribute | Value |
| --- | --- |
| Assignee |  |
| Accountable | Klaus Zanders |
| Product manager |  |
| Developers |  |
| Designer |  |
| Ordered by |  |
| Signed off by |  |
| Interest by |  |

## Planning

| Attribute | Value |
| --- | --- |
| Relevance |  |

## Costs

| Attribute | Value |
| --- | --- |
| Votes |  |
| Work |  |
| Labor costs |  |

## Description

### Steps to reproduce

1.  Be a user that has **more than one** two factor authentication method set up.

2.  Try to log in as that user

3.  On the screen where the 2FA options are shown, switch to another method, don't do anything further

4.  As an administrator, delete **all** the users two factor account methods

5.  As the user, try to sign in again, enter email and password and try to sign in

### What is the buggy behavior?

  - Instead of successfully logging in it shows a 500 error

This behavior showed up, when my old community account was reactivated and I do not have access to the old two factor code anymore. So I tried to sign in, an administrator deleted my 2fa methods and then I tried to sign in again.

The fix was deleting my session cookie and then logging in again.

Reason for this is that the session has the currently selected 2fa device stored in a session variable and when trying to find this device it throws the error because it cannot be found anymore

### What is the expected behavior?

1.  The user should be able to sign in, eventhough the session currently has a non existant 2fa device stored.

### Screenshots and other files

*If you have screenshots of the application's bug behavior or other relevant files, please drag them into this place or attach them using the "Files" section.*

### Environment information

*Community*

**OpenProject version**

*15.0.1*

**Browser**

- [ ] Chrome
- [x] Firefox
- [ ] Safari
- [ ] Mobile Safari
- [ ] Other (please specify)

**Operating System**

- [ ] Windows
- [x] Mac OS X
- [ ] Mobile iOS
- [ ] Mobile Android
- [ ] Linux (please specify distro)
- [ ] Chrome OS
- [ ] Other (please specify)

**Language**

*German*