This is quite common, and it strictly depends on teh security policies for each company. There are a few reasons why the password recovery process might not be suspended when a user navigates to another page.
- Session timeout: Some websites have a session timeout policy that automatically expires a user's session after a certain period of inactivity. This helps to prevent unauthorized access to user accounts. However, if the user is only navigating to another page on the same website, their session will not expire and they will be able to continue with the password recovery process.
- Security: Some websites choose not to suspend the password recovery process because they believe it would make it more difficult for users to recover their passwords. If a user's session were suspended, they would have to start the entire process over again, which could be frustrating and time-consuming.
- Convenience: Some websites prioritize convenience over security. They may choose not to suspend the password recovery process because they want to make it as easy as possible for users to regain access to their accounts.
Now, I don't know why Facebook, doe sthis, but I assume they decided that the convenience of allowing users to continue with the password recovery process even if they navigate to another page is more important than the security risk of someone else being able to use the OTP token. For example, what if the token arrives by email and they navigate to Gmail? If the OTP is cancelled, then the user will need to do the whole process again until he realizes he must open Gmail on another window or check in another device.
But again: this depends on each companie's policies, other websites have different policies and they actually stop the process, just like you say.