wordpress-mobile / wordpress-mobile/WordPress-Android

No message shown when SMS rate limiting applies

Open
#16,035 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

[Type] Enhancement Login
Dominant language
Kotlin
Stars
3.2k
Forks
1.4k
Avg merge
1d 11h
Merged PRs (30d)
69

Description

Expected behavior

When logging in via SMS-based two-factor authentication (2FA), the app should display a message to the user if it unable to send the SMS code (e.g. due to rate-limiting of one message per minute).

Actual behavior

When the app is unable to send an SMS code, it doesn't notify the user. Instead, the message simply doesn't arrive and this leads to potential user confusion.

Steps to reproduce the behavior
  1. Locate a WP.com account with SMS-based 2FA
  2. The following steps should be done in quick succession (within 60 seconds):
    a. Perform an action that requires an SMS code to be used (e.g. change the account password on WordPress.com via the browser)
    b. Log in to the WPAndroid app and notice the app indicates that a message has been sent
  3. Notice that no SMS is received
  4. (Optional) Wait till 60 seconds after Step 2a was performed and try again: notice that the SMS arrives correctly
Desired solution

It would be nice to show a message similar to WP.com, which displays "SMS codes are limited to once per minute. Please wait and try again". This was discussed in https://github.com/wordpress-mobile/WordPress-Android/issues/15961#issuecomment-1046830033.

Screen Shot 2022-03-02 at 17 14 06
Tested on Samsung S10, Android 11, WPAndroid 19.2

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start from the Android SMS-based 2FA login flow and review the discussion in issue #15961. Reproduce the rate-limit case by requesting codes within one minute, then trace how the failed SMS request is handled. Done means the app displays a clear wait-and-try-again message when the SMS cannot be sent.

Written by the indexing model from the issue text.

Assessment

Tech stack
android
Domain
authentication, mobile
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.