authgear / authgear/authgear-server
[Lockout] Reset timer can be smaller than Lockout Duration
- Dominant language
- Go
- Stars
- 2k
- Forks
- 125
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 32
Description
## Background:
Device / Browser (OS version): Chrome on Mac
Build: staging 2023-08-08.0, Tested on: 14 Aug 2023
## Description:
`Reset failed attempts after (minutes)` can be smaller than `Lockout Duration (minutes)`, i.e. Backoff Factor will never be triggered and maximum threshold will never be reached.
## Steps to reproduce:
1. Login Admin Portal, Select any project
2. In Sidebar select Authentication, Login Methods
3. Select Account Lockout Policy
4. Enter `Reset failed attempts after (minutes)` with a value smaller than `Lockout Duration (minutes)`
5. Trigger a Lockout with an account for 2 times, see no Backoff Factor applied
## Expected result:
Warn the user when `Reset failed attempts after (minutes)` smaller than `Lockout Duration (minutes)`.
## Screenshot:
Contributor guide
Research direction
Start in the Admin Portal flow at Authentication > Login Methods > Account Lockout Policy. Reproduce the case where Reset failed attempts after is smaller than Lockout Duration, then identify the existing validation or warning entry point. Done means the user is warned for that invalid relationship and the behavior is covered by the relevant test.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- authentication
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 38/100