aws-amplify / aws-amplify/amplify-android
[Auth] Amplify cancels sign in if user inputs an incorrect password when using USER_AUTH
- Dominant language
- Java
- Stars
- 287
- Forks
- 132
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 45
Description
### Before opening, please confirm:
- [x] I have [searched for duplicate or closed issues](https://github.com/aws-amplify/amplify-android/issues?q=is%3Aissue+) and [discussions](https://github.com/aws-amplify/amplify-android/discussions).
### Language and Async Model
Not applicable
### Amplify Categories
Authentication
### Gradle script dependencies
Amplify 2.30.0
### Environment information
n/a
### Please include any relevant guides or documentation you're referencing
_No response_
### Describe the bug
If the application is configured to use the USER_AUTH authentication flow, when user inputs an incorrect password the state machine cancels the sign in. This results in a subsequent attempt to correct the password failing with an `InvalidStateException`, and instead the application must go back to the start of the process to resubmit the username.
This makes sense in a classic Srp sign in where inputting the password is the first thing that happens, but not in a USER_AUTH sign in where the password entry comes midway through the flow.
If the user has multiple auth factors available this requires either a very bad user experience or a messy workaround on the part of the application developer to somehow repeat the same steps in the background.
Amplify should instead keep the sign in alive so that user can attempt to correct the password and continue with the flow.
### Reproduction steps (if applicable)
_No response_
### Code Snippet
```kotlin
// Put your code below this line.
```
### Log output
```
// Put your logs below this line
```
### Configuration File
_No response_
### GraphQL Schema
```graphql
// Put your schema below this line
```
### Additional information and screenshots
_No response_
Contributor guide
Research direction
Start by reproducing the USER_AUTH flow with Amplify 2.30.0 and trace the sign-in state machine after an incorrect password. Done means a failed password attempt leaves the flow active, allows the password to be corrected, and avoids the subsequent InvalidStateException.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- android, kotlin
- Domain
- authentication, mobile
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100