authgear / authgear/authgear-server

[Lockout] Password input shown without lockout warning during lockout period

Open
#3,312 0 comments 0 reactions 0 assignees View on GitHub
bug/trivial reported by qa
Dominant language
Go
Stars
2k
Forks
125
Avg merge
2d 17h
Merged PRs (30d)
32

Description

## Background:
Device / Browser (OS version): Chrome on Mac
Build: staging 2023-08-08.0, Tested on: 14 Aug 2023

## Description:
During Lockout period, if user create a new tab trying to login or duplicate the password tab, the Password UI is shown without lockout warning and the Next button can be pressed. However, login is stopped even with correct password while lockdown

## Steps to reproduce:
1. Login with Auth UI
2. Trigger a Lockout
3. Duplicate the password input tab or Create a new tab to login with the same locked out user
4. See Password input is shown without lockout warning and the Next button can be pressed

## Expected result:
Don't show normal password UI when user is locked out.

## Screenshot:
https://github.com/authgear/authgear-server/assets/4337525/d24f1610-fafd-4db8-96c1-e3863f679bce

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the lockout flow in Chrome on Mac: trigger a lockout, then duplicate the password tab or open a new login tab for the same user. Trace how the password UI determines the lockout state; done means the locked-out user sees the lockout warning instead of the normal password UI and cannot proceed with Next.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
authentication
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.