# Unable to confirm new email when two factor backup codes are enabled
**URL:** https://meta.discourse.org/t/unable-to-confirm-new-email-when-two-factor-backup-codes-are-enabled/133185
**Category:** Bug
**Created:** [November 12, 2019, 10:59am UTC](https://meta.discourse.org/t/unable-to-confirm-new-email-when-two-factor-backup-codes-are-enabled/133185 "2019-11-12T10:59:46Z")
**Posts on this page:** 12
**Page:** 1
### Author:  [@arun](https://meta.discourse.org/u/arun)
#### Post date: [November 12, 2019, 10:59am UTC](https://meta.discourse.org/t/unable-to-confirm-new-email-when-two-factor-backup-codes-are-enabled/133185/1 "2019-11-12T10:59:46Z")
When `two factor backup codes` are enabled, confirming a new email address fails with this error:
```plaintext
Oops
The software powering this discussion forum encountered an unexpected problem. We apologize for the inconvenience.
Detailed information about the error was logged, and an automatic notification generated. We'll take a look at it.
No further action is necessary. However, if the error condition persists, you can provide additional detail, including steps to reproduce the error, by posting a discussion topic in the site's feedback category.
```
This happens across multiple Discourse setups, so, isn’t specific to one.
Turning off the `two factor backup codes` feature resolves the issue, and email verification goes through fine.
Full steps to reproduce the issue:
- Start with an account on any Discourse (can use [https://try.discourse.org/](https://try.discourse.org/) for testing)
- Setup 2FA with TOTP (I have not tested with physical security keys)
- Change email on your account
- Click on verification email sent to the new email inbox. **Notice that the verification goes through**.
- Enable `two factor backup codes` on your 2FA settings.
- Change email on account again.
- Click on verification email sent to the newest email inbox. **Notice that the verification fails with the error noted earlier**.
- Turn off `two factor backup codes`.
- Change email again.
- Click on the verification email sent to the newest address.
- You will be asked to enter the TOTP code.
- **This time the verification of the newest email goes through fine**.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [November 12, 2019, 7:00pm UTC](https://meta.discourse.org/t/unable-to-confirm-new-email-when-two-factor-backup-codes-are-enabled/133185/2 "2019-11-12T19:00:51Z")
Did you check /logs in your web browser when logged in as an admin to see what the actual error is? I think we would have seen this on our sites if it was an actual bug.
---
### Author:  [@featheredtoast](https://meta.discourse.org/u/featheredtoast)
#### Post date: [November 12, 2019, 7:05pm UTC](https://meta.discourse.org/t/unable-to-confirm-new-email-when-two-factor-backup-codes-are-enabled/133185/3 "2019-11-12T19:05:58Z")
Also, is this with security keys, or totp tokens? Regardless, we will need specific reproduction steps here (either in a dev environment, or [try.discourse.org](http://try.discourse.org)) so we can confirm.
---
### Author:  [@Whitestrake](https://meta.discourse.org/u/Whitestrake)
#### Post date: [November 12, 2019, 11:17pm UTC](https://meta.discourse.org/t/unable-to-confirm-new-email-when-two-factor-backup-codes-are-enabled/133185/4 "2019-11-12T23:17:33Z")
Just to chip in, it doesn’t look like there were any relevant logged errors over at Caddy’s forums.
> **[Unable to change email on this Discourse](https://caddy.community/t/unable-to-change-email-on-this-discourse/6487/2?u=whitestrake)**
>
> That’s weird, I can’t find any errors in the logs related to changing email addresses. (Maybe the developers were notified directly?) Er… anyway… I just did an upgrade (they have new versions like every week), so you might try again. If that...
---
### Author:  [@arun](https://meta.discourse.org/u/arun)
#### Post date: [November 13, 2019, 2:33am UTC](https://meta.discourse.org/t/unable-to-confirm-new-email-when-two-factor-backup-codes-are-enabled/133185/5 "2019-11-13T02:33:05Z")
Thanks for interlinking the threads!
---
### Author:  [@arun](https://meta.discourse.org/u/arun)
#### Post date: [November 13, 2019, 2:33am UTC](https://meta.discourse.org/t/unable-to-confirm-new-email-when-two-factor-backup-codes-are-enabled/133185/6 "2019-11-13T02:33:46Z")
Good point. This turns out to be an issue only when `two factor backup codes` are enabled. I have updated the post with the new details and steps to reproduce.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [November 13, 2019, 2:37am UTC](https://meta.discourse.org/t/unable-to-confirm-new-email-when-two-factor-backup-codes-are-enabled/133185/7 "2019-11-13T02:37:26Z")
How do we feel about these repro steps @tshenry? The sequence seems a bit odd to me.
---
### Author:  [@arun](https://meta.discourse.org/u/arun)
#### Post date: [November 13, 2019, 2:55am UTC](https://meta.discourse.org/t/unable-to-confirm-new-email-when-two-factor-backup-codes-are-enabled/133185/8 "2019-11-13T02:55:48Z")
I didn’t mean to say that the email needs to be updated multiple times. It’s to indicate that the email verification fails only when backup codes are enabled, and not otherwise.
---
### Author:  [@tshenry](https://meta.discourse.org/u/tshenry)
#### Post date: [November 13, 2019, 5:54pm UTC](https://meta.discourse.org/t/unable-to-confirm-new-email-when-two-factor-backup-codes-are-enabled/133185/10 "2019-11-13T17:54:33Z")
There’s definitely a bug here. To refine repro steps a bit:
1. Setup 2FA with TOTP
2. Enable backup codes
3. Change email address
4. Select the verification link in the confirmation email
5. Get hit with the “Oops” page
I can confirm that disabling the backup codes will immediately fix the issue, even when using the same email verification link.
Error log shows:
```plaintext
ActionView::Template::Error (Missing partial common/_second_factor_form_script with {:locale=>[:en_US, :en], :formats=>[:html], :variants=>[], :handlers=>[:raw, :erb, :html, :builder, :ruby]}. Searched in:
* "/var/www/discourse/app/views"
)
/var/www/discourse/vendor/bundle/ruby/2.6.0/gems/actionview-6.0.1/lib/action_view/path_set.rb:48:in `find'
```
Which I believe relates to this line here: [https://github.com/discourse/discourse/blob/master/app/views/users\_email/confirm.html.erb#L36](https://github.com/discourse/discourse/blob/master/app/views/users_email/confirm.html.erb#L36)
That references a file that is indeed missing: [discourse/app/views/common at main · discourse/discourse · GitHub](https://github.com/discourse/discourse/tree/master/app/views/common)
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [November 13, 2019, 6:18pm UTC](https://meta.discourse.org/t/unable-to-confirm-new-email-when-two-factor-backup-codes-are-enabled/133185/11 "2019-11-13T18:18:09Z")
Thanks @arun — we should get this fixed @eviltrout
---
### Author:  [@blake](https://meta.discourse.org/u/blake)
#### Post date: [November 14, 2019, 11:32pm UTC](https://meta.discourse.org/t/unable-to-confirm-new-email-when-two-factor-backup-codes-are-enabled/133185/14 "2019-11-14T23:32:53Z")
This has been fixed via this commit:
[https://github.com/discourse/discourse/commit/3b16eb7abb2986132d3f7fdfe36d1d21e0d650bb](https://github.com/discourse/discourse/commit/3b16eb7abb2986132d3f7fdfe36d1d21e0d650bb)
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [November 15, 2019, 7:01pm UTC](https://meta.discourse.org/t/unable-to-confirm-new-email-when-two-factor-backup-codes-are-enabled/133185/15 "2019-11-15T19:01:19Z")