OAuth 2.0 authorization flow redirects to start.atlassian.com if user logged in

[Joe Thatcher]

I am developing an internal web app which relies on Atlassian OAuth 2.0 to authenticate users with as well as using the Jira cloud API.

When the user visits the web app for the first time, and they don't have an access token, they are redirected to the authorization URL. The normal login/consent screen process happens, and once they click "allow", they are redirected back to the app as normal, and their access tokens are stored.

If a user who has previously authorised the app or is still logged into Atlassian, but does not have a session visits it, the exact same process as above happens. However, for whatever reason, the user is instead redirected to "start.atlassian.com" instead of back to the app, unless they sign out of Atlassian too.

For this condition, I observed the following series of requests:

`GET http://localhost:9292/ -> 302 to https://auth.atlassian.com/oauth/authorize?redirect_uri=http://localhost:9292/oauth/callback (params omitted)`

`GET https://auth.atlassian.com/oauth/authorize -> 302 to https://id.atlassian.com/oidc/oauth/consent?continue_url=(url above) (params omitted)`

`GET https://id.atlassian.com/oidc/oauth/consent -> 302 to https://id.atlassian.com/login (no params)`

`GET https://id.atlassian.com/login -> 303 to https://id.atlassian.com/login/authorize?token=(redacted)`

`GET https://id.atlassian.com/login/authorize?token=(redacted) -> 200 (then redirects to start.atlassian.com through the HTML body)`

It seems the `redirect_uri` is getting lost at some point, but maybe I am doing something wrong. In all other cases it authorizes successfully. As well as a few Jira scopes I also have the `offline_access` scope, are there any other scopes that I need?