Skip to content

accountLockout not resetting threshold after configured duration #9386

Open
#10538
Open
accountLockout not resetting threshold after configured duration#9386
#10538
Labels
type:bugImpaired feature or lacking behavior that is likely assumed

Description

@messagenius-admin
messagenius-admin
opened on Oct 28, 2024

When using Account Lockout options, multiple login attempts result in the user being locked out for a specified period. After the lockout duration expires, the app should allow the user to attempt the configured number of login attempts again.
However the user is locked out immediately after just one failed login attempt.

Steps to Reproduce

  1. Set the accountLockout config, for example: 
    "accountLockout": {
    "duration": 2,
    "threshold": 5 
}

This sample configuration will lock the user out for 2 minutes after 5 failed attempts.

  1. Perform a login with wrong cretentials, 5 times within 2 minutes.
  2. Observe that you are correctly locked out
  3. Wait for the lockout period to end.
  4. Attempt to log in again using incorrect credentials.

Actual Outcome

The user gets locked out again after a single failed attempt.

Expected Outcome

The user should be able to make the configured number (5 in the above example) of additional attempts before being locked out again.

Environment

Parse Server version: 7.3.0
OS/Host: Any
Database: Any
Client: Any, including REST

Activity

  1. parse-github-assistant commented on Oct 28, 2024

    @parse-github-assistant
    parse-github-assistantbot
    on Oct 28, 2024 – with Parse GitHub Assistant

    Thanks for opening this issue!

  2. messagenius-admin
    changed the title [-]accountLockout not resetting threshold after duration[/-] [+]accountLockout not resetting threshold after configured duration[/+] on Oct 28, 2024

  3. mtrezza commented on Oct 29, 2024

    @mtrezza
    mtrezza
    on Oct 29, 2024
    Member

    Could you submit a PR with and duplicate an existing test for this option, where you test this scenario?

  4. mtrezza
    added
    type:bugImpaired feature or lacking behavior that is likely assumed
    on Oct 29, 2024

  5. mtrezza commented on Jul 26, 2026

    @mtrezza
    mtrezza
    on Jul 26, 2026
    Member

    The docs are unclear and silent on the counter-reset behavior. The proposed "expected outcome" would weaken security behavior. One can argue that developers also depend on actual behavior, not only docs. Since this is a long-standing bug, combined with unclear docs, this security-relevant relaxation should not go unnoticed. We effectively treat it as breaking change.

    Suggestion for quick fix: new bool option accountLockout.resetCountOnExpiry (default false to keep current behavior). Fix docs to describe post-expiry counter behavior.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    type:bugImpaired feature or lacking behavior that is likely assumed

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions