authgear / authgear/authgear-server
[Lockout] Password input shown without lockout warning during lockout period
- Dominant language
- Go
- Stars
- 2k
- Forks
- 125
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 32
Description
## Background:
Device / Browser (OS version): Chrome on Mac
Build: staging 2023-08-08.0, Tested on: 14 Aug 2023
## Description:
During Lockout period, if user create a new tab trying to login or duplicate the password tab, the Password UI is shown without lockout warning and the Next button can be pressed. However, login is stopped even with correct password while lockdown
## Steps to reproduce:
1. Login with Auth UI
2. Trigger a Lockout
3. Duplicate the password input tab or Create a new tab to login with the same locked out user
4. See Password input is shown without lockout warning and the Next button can be pressed
## Expected result:
Don't show normal password UI when user is locked out.
## Screenshot:
https://github.com/authgear/authgear-server/assets/4337525/d24f1610-fafd-4db8-96c1-e3863f679bce
Contributor guide
Research direction
Start by reproducing the lockout flow in Chrome on Mac: trigger a lockout, then duplicate the password tab or open a new login tab for the same user. Trace how the password UI determines the lockout state; done means the locked-out user sees the lockout warning instead of the normal password UI and cannot proceed with Next.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- authentication
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100