Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

accountLockout not resetting threshold after configured duration #9386

Open
messagenius-admin opened this issue Oct 28, 2024 · 2 comments
Open
Labels
type:bug Impaired feature or lacking behavior that is likely assumed

Comments

@messagenius-admin
Copy link

When using Account Lockout options, multiple login attempts result in the user being locked out for a specified period. After the lockout duration expires, the app should allow the user to attempt the configured number of login attempts again.
However the user is locked out immediately after just one failed login attempt.

Steps to Reproduce

  1. Set the accountLockout config, for example:
    "accountLockout": {
        "duration": 2,
        "threshold": 5 
    }

This sample configuration will lock the user out for 2 minutes after 5 failed attempts.

  1. Perform a login with wrong cretentials, 5 times within 2 minutes.
  2. Observe that you are correctly locked out
  3. Wait for the lockout period to end.
  4. Attempt to log in again using incorrect credentials.

Actual Outcome

The user gets locked out again after a single failed attempt.

Expected Outcome

The user should be able to make the configured number (5 in the above example) of additional attempts before being locked out again.

Environment

Parse Server version: 7.3.0
OS/Host: Any
Database: Any
Client: Any, including REST

Copy link

Thanks for opening this issue!

@messagenius-admin messagenius-admin changed the title accountLockout not resetting threshold after duration accountLockout not resetting threshold after configured duration Oct 28, 2024
@mtrezza
Copy link
Member

mtrezza commented Oct 29, 2024

Could you submit a PR with and duplicate an existing test for this option, where you test this scenario?

@mtrezza mtrezza added the type:bug Impaired feature or lacking behavior that is likely assumed label Oct 29, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
type:bug Impaired feature or lacking behavior that is likely assumed
Projects
None yet
Development

No branches or pull requests

2 participants