authgear / authgear/authgear-server

[Lockout] Reset timer can be smaller than Lockout Duration

Open
#3,310 0 comments 0 reactions 0 assignees View on GitHub
reported by qa ux/trivial
Dominant language
Go
Stars
2k
Forks
125
Avg merge
2d 17h
Merged PRs (30d)
32

Description

## Background:
Device / Browser (OS version): Chrome on Mac
Build: staging 2023-08-08.0, Tested on: 14 Aug 2023

## Description:
`Reset failed attempts after (minutes)` can be smaller than `Lockout Duration (minutes)`, i.e. Backoff Factor will never be triggered and maximum threshold will never be reached.

## Steps to reproduce:
1. Login Admin Portal, Select any project
2. In Sidebar select Authentication, Login Methods
3. Select Account Lockout Policy
4. Enter `Reset failed attempts after (minutes)` with a value smaller than `Lockout Duration (minutes)`
5. Trigger a Lockout with an account for 2 times, see no Backoff Factor applied

## Expected result:
Warn the user when `Reset failed attempts after (minutes)` smaller than `Lockout Duration (minutes)`.

## Screenshot:
Screenshot 2023-08-14 at 6 28 01 PM

Contributor guide

Open the contributing guide

Research direction

Start in the Admin Portal flow at Authentication > Login Methods > Account Lockout Policy. Reproduce the case where Reset failed attempts after is smaller than Lockout Duration, then identify the existing validation or warning entry point. Done means the user is warned for that invalid relationship and the behavior is covered by the relevant test.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
authentication
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.