aws-amplify / aws-amplify/amplify-android

[Auth] Amplify cancels sign in if user inputs an incorrect password when using USER_AUTH

Open
#3,139 1 comment 0 reactions 0 assignees View on GitHub
auth bug
Dominant language
Java
Stars
287
Forks
132
Avg merge
2d 2h
Merged PRs (30d)
45

Description

### Before opening, please confirm:

- [x] I have [searched for duplicate or closed issues](https://github.com/aws-amplify/amplify-android/issues?q=is%3Aissue+) and [discussions](https://github.com/aws-amplify/amplify-android/discussions).

### Language and Async Model

Not applicable

### Amplify Categories

Authentication

### Gradle script dependencies

Amplify 2.30.0

### Environment information

n/a

### Please include any relevant guides or documentation you're referencing

_No response_

### Describe the bug

If the application is configured to use the USER_AUTH authentication flow, when user inputs an incorrect password the state machine cancels the sign in. This results in a subsequent attempt to correct the password failing with an `InvalidStateException`, and instead the application must go back to the start of the process to resubmit the username.

This makes sense in a classic Srp sign in where inputting the password is the first thing that happens, but not in a USER_AUTH sign in where the password entry comes midway through the flow.

If the user has multiple auth factors available this requires either a very bad user experience or a messy workaround on the part of the application developer to somehow repeat the same steps in the background.

Amplify should instead keep the sign in alive so that user can attempt to correct the password and continue with the flow.

### Reproduction steps (if applicable)

_No response_

### Code Snippet

```kotlin
// Put your code below this line.

```

### Log output

```
// Put your logs below this line

```

### Configuration File

_No response_

### GraphQL Schema

```graphql
// Put your schema below this line

```

### Additional information and screenshots

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the USER_AUTH flow with Amplify 2.30.0 and trace the sign-in state machine after an incorrect password. Done means a failed password attempt leaves the flow active, allows the password to be corrected, and avoids the subsequent InvalidStateException.

Written by the indexing model from the issue text.

Assessment

Tech stack
android, kotlin
Domain
authentication, mobile
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.