authgear / authgear/authgear-server
[Email Magiclink] No prompt when rate limit is reached
- Dominant language
- Go
- Stars
- 2k
- Forks
- 125
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 32
Description
## Background
- Environment: Staging
- Authgear staging app: qa-authflow from Token Demo Web App
- Testing account: Any email account
## Description
No prompt for enduser to press Resend to receive the magiclink after the rate limit is finished, as both normal countdown timer and the countdown timer under rate limit are the same.
## Steps to reproduce
Trigger rate limit by login logout login quickly in 1 min
1. From demo app, click Sign in
2. Fill in email and click Login
3. Note the countdown timer
4. Check email and click magic link
5. When redirected to demo app, click sign out and click Sign in Again
6. Fill in email and click Login
7. Under rate limit, Note the countdown timer is the same as the previous one.
8. Check email, see no email.
9. Wait for 1 min to pass, still see no email.
10. Press Resend, finally see email.
## Expected result
Prompt user that they are under rate limit, instruct them to wait and press Resend after rate limit is finished.
## Screenshot
https://github.com/authgear/authgear-server/assets/4337525/e5d6a3cb-a998-47e7-b3a8-ab4406b777a5
Contributor guide
Research direction
Reproduce the flow in the Token Demo Web App with the qa-authflow staging app: trigger the rate limit by logging in and out quickly, then compare the normal and rate-limit countdowns. Trace the sign-in and Resend flow to determine how the enduser is informed and when Resend becomes usable. Done means the interface clearly tells the user to wait for the rate limit and press Resend afterward, with a magic link then arriving.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- authentication, frontend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100