parse-community / parse-community/parse-server

accountLockout not resetting threshold after configured duration

Open
#9,386 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

type:bug
Dominant language
JavaScript
Stars
21.4k
Forks
4.8k
Avg merge
7h 45m
Merged PRs (30d)
11

Description

When using Account Lockout options, multiple login attempts result in the user being locked out for a specified period. After the lockout duration expires, the app should allow the user to attempt the configured number of login attempts again.
However the user is locked out immediately after just one failed login attempt.

Steps to Reproduce
  1. Set the accountLockout config, for example:
    "accountLockout": {
        "duration": 2,
        "threshold": 5 
    }
    

This sample configuration will lock the user out for 2 minutes after 5 failed attempts.

  1. Perform a login with wrong cretentials, 5 times within 2 minutes.
  2. Observe that you are correctly locked out
  3. Wait for the lockout period to end.
  4. Attempt to log in again using incorrect credentials.
Actual Outcome

The user gets locked out again after a single failed attempt.

Expected Outcome

The user should be able to make the configured number (5 in the above example) of additional attempts before being locked out again.

Environment

Parse Server version: 7.3.0
OS/Host: Any
Database: Any
Client: Any, including REST

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by tracing the accountLockout handling in Parse Server and reproduce the sequence described: reach the threshold, wait for the configured duration, then make another failed login. Confirm that the failed-attempt counter resets after lockout expiry and that the configured number of new attempts is allowed before locking the user again.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, node.js
Domain
authentication, backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
62/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.