FR: successful password reset should unlock account locked via accountLockout policy #6773
Description
Running parse server 4.2.0 with accountLockout policy configured to enable locking accounts when incorrect password is entered multiple times.
What I found out is that when a user gets locked out due to many failed login attempts, and then performs a password reset successfully, the account remains locked.
I thinks a successful password reset should unlock the account.
What do you think?
Martin
Activity
mtrezza commentedon Jul 4, 2020
I think it makes sense. I just tried out Twitter's account lock policy and it works the way you describe:
However, this is a matter of policy, which can be different depending on the use case of Parse Server. In some systems, a locked account cannot be unlocked by a user anymore and does not unlock itself, only an admin can unlock the account.
I think it would be a good enhancement and suggest to add this as an option to the Parse Server configuration.
stale commentedon Nov 8, 2020
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.
mman commentedon Nov 8, 2020
This should remain open
mtrezza commentedon Jan 28, 2021
The PR above introduces an option to define this behavior. The PR is currently in review.