parse-community / parse-community/parse-server
accountLockout not resetting threshold after configured duration
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 21.4k
- Forks
- 4.8k
- Avg merge
- 7h 45m
- Merged PRs (30d)
- 11
Description
When using Account Lockout options, multiple login attempts result in the user being locked out for a specified period. After the lockout duration expires, the app should allow the user to attempt the configured number of login attempts again.
However the user is locked out immediately after just one failed login attempt.
Steps to Reproduce
- Set the accountLockout config, for example:
"accountLockout": { "duration": 2, "threshold": 5 }
This sample configuration will lock the user out for 2 minutes after 5 failed attempts.
- Perform a login with wrong cretentials, 5 times within 2 minutes.
- Observe that you are correctly locked out
- Wait for the lockout period to end.
- Attempt to log in again using incorrect credentials.
Actual Outcome
The user gets locked out again after a single failed attempt.
Expected Outcome
The user should be able to make the configured number (5 in the above example) of additional attempts before being locked out again.
Environment
Parse Server version: 7.3.0
OS/Host: Any
Database: Any
Client: Any, including REST
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the accountLockout handling in Parse Server and reproduce the sequence described: reach the threshold, wait for the configured duration, then make another failed login. Confirm that the failed-attempt counter resets after lockout expiry and that the configured number of new attempts is allowed before locking the user again.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, node.js
- Domain
- authentication, backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 62/100