Login Action - api.access.deny and api.redirect.sendUserTo Looping after Call

This article addresses the issue of an infinite redirect loop encountered when implementing custom login actions for "Sign In with Google" functionality. Specifically, it examines the scenario where a custom action is designed to validate email invitations and deny access to uninvited users, leading to an unintended and persistent redirection loop.

• api.access.deny
• api.redirect.sendUserTo
• Action

The looping occurs because the user has a valid, active session with Google. 

1. A login attempt triggers the custom Action.
2. The Action redirects the user to the application's login endpoint.
3. The application's login endpoint initiates an /authorize call, specifying the Google social connection.
4. The /authorize call immediately redirects the user to Google.
5. Google already has a valid user session.
6. Google's valid session triggers the Action pipeline again.
7. The Action pipeline results in a failed login (due to the email validation).
8. The Action redirects the user back to the application's login endpoint, restarting the loop from step 3.

Before navigating to their application's login endpoint, first make a federated logout call to Google so that this user can go through the login flow again, breaking the loop.