[Due for payment 2026-03-02] [$250] 2FA - After clicking Got it on the success screen, the user is redirected to the Inbox

[jponikarchuk]

If you haven’t already, check out our contributing guidelines for onboarding and email contributors@expensify.com to request to join our Slack channel!

---

Version Number: v9.3.6-0
Reproducible in staging?: Yes
Reproducible in production?: No
If this was caught during regression testing, add the test name, ID and link from BrowserStack: https://test-management.browserstack.com/projects/2219752/test-runs/TR-3235/folder/13176687/41236669/1141126468?sort=%2Bidentifier
Email or phone of affected tester (no customers): n/a
Issue reported by: Applause Internal Team
Bug source: Regression TC Execution
Device used: Mac 15.4.1 Safari, iPhone 13 iOS 26.2
App Component: User Settings

Action Performed:

1. Go to https://staging.new.expensify.com
   2.Navigate to Settings > Security > Two Factor Authentication (2FA)
   3.Click on "Copy"
   4.Click Next
   5.Open your authenticator app and scan the QR or paste the secret key to set up the authenticator
2. Enter the 6 digit code provided by the authenticator app
   7.Click Next
   8.Verify a success screen is displayed and that it contains an animation
3. Click Got it

Expected Result:

The user is redirected to the Two-factor authentication page with 2FA enabled, and a Security page is displayed on the background

Actual Result:

After clicking Got it on the success screen, the user is redirected to the Inbox

Workaround:

Unknown

Platforms:

• Android: App
• Android: mWeb Chrome
• iOS: App
• iOS: mWeb Safari
• iOS: mWeb Chrome
• Windows: Chrome
• MacOS: Chrome / Safari

Screenshots/Videos

1.mp4

View all open jobs on GitHub

Upwork Automation - Do Not Edit

• Upwork Job URL: https://www.upwork.com/jobs/~022016318810973611736
• Upwork Job ID: 2016318810973611736
• Last Price Increase: 2026-02-04
• Automatic offers:
• linhvovan29546 | Reviewer | 110478418

Issue Owner

Current Issue Owner: @JmillsExpensify

[melvin-bot]

Triggered auto assignment to @JmillsExpensify (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details. Please add this bug to a GH project, as outlined in the SO.

[melvin-bot]

Triggered auto assignment to @youssef-lr (DeployBlockerCash), see https://stackoverflowteams.com/c/expensify/questions/9980/ for more details.

[melvin-bot]

💬 A slack conversation has been started in #expensify-open-source

[github-actions]

👋 Friendly reminder that deploy blockers are time-sensitive ⏱ issues! Check out the open `StagingDeployCash` deploy checklist to see the list of PRs included in this release, then work quickly to do one of the following:

1. Identify the pull request that introduced this issue and revert it.
2. Find someone who can quickly fix the issue.
3. Fix the issue yourself.

[OSBotify]

Investigation Summary

Classification: Frontend bug
Causing PR: #77588 - "Fix flakiness in mandatory 2FA enforcement" by @chuckdries (High confidence)
Related Issues: None

Recommendation: REVERT

This PR introduced a regression in the 2FA success page navigation flow. The issue is specifically in the SuccessPage.tsx cleanup function that now always calls Navigation.popRootToTop() when the component unmounts, overriding the intended navigation back to the 2FA settings page.

Labels: Keeping DeployBlockerCash (App deploy is blocked). Removing DeployBlocker as this is a frontend-only issue.

Detailed Analysis

Evidence

The bug reproduces on staging (v9.3.6-0) but not production, and PR #77588 was included in the staging deploy checklist (#80164).

The reported issue states:

• Expected: After clicking "Got it" on 2FA success screen, user should be redirected to Two-factor authentication page with 2FA enabled, and Security page displayed in background
• Actual: User is redirected to Inbox instead

Verification

I reviewed the changes in PR #77588, specifically the modifications to /src/pages/settings/Security/TwoFactorAuth/SuccessPage.tsx:

Before PR #77588:

useEffect(() => {
    return () => {
        // When the 2FA RHP is closed, we want to remove the 2FA required page from the navigation stack too.
        if (route.params?.backTo !== ROUTES.REQUIRE_TWO_FACTOR_AUTH) {
            return;
        }
        Navigation.popRootToTop();
    };
}, []);

After PR #77588:

useEffect(() => {
    return () => {
        Navigation.popRootToTop();
    };
}, []);

The conditional check was removed, meaning Navigation.popRootToTop() now executes unconditionally when the SuccessPage component unmounts.

Root Cause

When a user completes the regular 2FA setup flow (not from mandatory enforcement):

1. User clicks "Got it" button on SuccessPage
2. The goBack() function is called with backTo parameter set to ROUTES.SETTINGS_2FA_ROOT.getRoute()
3. This calls quitAndNavigateBack(ROUTES.SETTINGS_2FA_ROOT.getRoute()) which should navigate to the 2FA settings page
4. As SuccessPage unmounts, the cleanup function runs Navigation.popRootToTop() unconditionally
5. This pops the navigation stack to the root (Inbox), overriding the intended navigation to the 2FA settings page

The PR author intended to simplify the 2FA enforcement flow logic, but inadvertently broke the regular 2FA setup navigation by removing the conditional that prevented popRootToTop() from running in non-enforcement scenarios.

[ZhenjaHorbach]

@chuckdries
It's our
But I think we can remove the deploy blocker label here
Since the current behavior is the same as for 2FA verification full screen

#77588 (comment)

So I guess we just need to improve the logic a little bit