Moving to letshang.io, and the sign-in I broke twice

Let's Hang started on letshang.dev. A few days in I bought letshang.io, because .dev is lovely for developers and slightly confusing for everyone's mum.

Moving a site is mostly redirects. Every old link on .dev now sends you to the same page on .io with a permanent redirect, so nothing shared in the first week is broken.

Sign-in was the part that bit me.

The first break

Right after the move, some people couldn't sign in with Google at all. The error turned out to have nothing to do with the domain. Google had started handing out profile photo links longer than 255 characters, and the column I stored them in was exactly 255 characters wide. The fix was one line in a database migration.

The second break

Then sign-in broke again, this time properly because of the domain. Google's sign-in flow remembers where it started, and it started on the old domain while the session lived on the new one. So you'd come back from Google to a site that had never heard of you.

The fix: start the Google flow on the domain Google knows, then hand the session over to letshang.io with a one-time token that works once and expires quickly.

A door without Google

Both breaks taught me something I should have known already. Not everyone has a Google account, and not everyone wants to use it.

So now you can also sign in with a six-digit code sent to your email. No password. The code lasts ten minutes, you get five tries, and one address can ask for five codes an hour. The Google button is still there, side by side, for people who prefer it.