wordpress-mobile / wordpress-mobile/WordPress-Android
No message shown when SMS rate limiting applies
Nobody has claimed this yet.
- Dominant language
- Kotlin
- Stars
- 3.2k
- Forks
- 1.4k
- Avg merge
- 1d 11h
- Merged PRs (30d)
- 69
Description
Expected behavior
When logging in via SMS-based two-factor authentication (2FA), the app should display a message to the user if it unable to send the SMS code (e.g. due to rate-limiting of one message per minute).
Actual behavior
When the app is unable to send an SMS code, it doesn't notify the user. Instead, the message simply doesn't arrive and this leads to potential user confusion.
Steps to reproduce the behavior
- Locate a WP.com account with SMS-based 2FA
- The following steps should be done in quick succession (within 60 seconds):
a. Perform an action that requires an SMS code to be used (e.g. change the account password on WordPress.com via the browser)
b. Log in to the WPAndroid app and notice the app indicates that a message has been sent - Notice that no SMS is received
- (Optional) Wait till 60 seconds after Step 2a was performed and try again: notice that the SMS arrives correctly
Desired solution
It would be nice to show a message similar to WP.com, which displays "SMS codes are limited to once per minute. Please wait and try again". This was discussed in https://github.com/wordpress-mobile/WordPress-Android/issues/15961#issuecomment-1046830033.
Tested on Samsung S10, Android 11, WPAndroid 19.2
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start from the Android SMS-based 2FA login flow and review the discussion in issue #15961. Reproduce the rate-limit case by requesting codes within one minute, then trace how the failed SMS request is handled. Done means the app displays a clear wait-and-try-again message when the SMS cannot be sent.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- android
- Domain
- authentication, mobile
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100