wordpress-mobile / wordpress-mobile/WordPress-Android

Login: SMS with verification code silently fails to be sent when using Google Sign-In with a disconnected 2FA account

Open
#12,424 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

[Status] Stale [Type] Bug Login
Dominant language
Kotlin
Stars
3.2k
Forks
1.4k
Avg merge
1d 11h
Merged PRs (30d)
69

Description

Expected behavior

I expected to either be able to receive a SMS with a verification code when my Google account is disconnected from my WordPress.com account or at least see an error explaining why it wasn't possible to send one.

Actual behavior

I don't receive a SMS and don't see any error message explaining why.

Steps to reproduce the behavior
  1. Start with an account with Google sign-in and two-factor authentication enabled via SMS.
  2. Try to log in with your Google account.
  3. You should receive the SMS with the verification code and be able to log in normally.
  4. Quickly log out and try to log in again.
  5. You should see a "Too many attempts" error, which is expected.
  6. From the web, disconnect your Google account on the Social Login page.
  7. Try to log in again.
  8. Notice how the "Too many attempts" error is never shown.
  9. Notice the Email/Password screen.
  10. Enter your WordPress.com account password.
  11. Tap Continue.
  12. Notice the 2FA screen.
  13. Notice how no SMS was received.
  14. Tap "Text me a code instead".
  15. Notice how no SMS was received again.
  16. Notice how no error is shown.
Tested on Pixel 3 XL, Android 10, WPAndroid 15.2-rc-2

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the Google Sign-In, disconnected-account, password, and 2FA flow described on the tested Android setup. Trace the login path around the Email/Password screen, 2FA screen, and “Text me a code instead” action. Done means the flow either sends the SMS or displays an explanatory error instead of failing silently.

Written by the indexing model from the issue text.

Assessment

Tech stack
android, kotlin
Domain
authentication, mobile
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.