[$100] Error message is not displayed if user enters wrong PIN so many times

[sdgun]

Steps to Reproduce

• Open the URL https://connect.topcoder-dev.com

• Click 'Login' > Register for Free

• Fill all the required data and click Confirm

• Once the PIN is requesting enter wrong PINs multiple times (10-20 times)

• Observe

Actual Result(s)

• Error message is not displayed if user enters wrong PIN so many times

Expected Result(s)

• Error message must display if user enters wrong PIN so many times ("Whoops, you entered the wrong PIN too many times. If you still can't get your PIN, please contact support@connect.com")
• This attempt must not exceed more than 3-5 attempts

URL where the Bug Appears

https://accounts.topcoder-dev.com/connect/pin-verification

Image/Video/JS Log/Console Log (If not attached here, Please check the comments section)

https://www.screencast.com/t/FFFpEC0fW8VC

Expected Error message:

Environment

• Device(s): Laptop
• Operating System: Windows 7 Pro (64bit)
• Browser: Google Chrome 59.0.3071.115 (Official Build) (64-bit) / IE11
• User role (client, copilot or manager): not logged in
• Account used: NA

[gondzo]

@vikasrohit do we have support for this in API? did we drop this along the way ?

[vikasrohit]

Not as of now. We might have to put this in front end for now. @fnisen what is your opinion?

[fnisen]

Good point. Yes, we should have a block just so someone doesn't maliciously hammer the API. @vikasrohit I think we do have something like this for Password Reset, for example, where we lock you out for some time after 10 attempts. It's probably best to do this at the API level, so I should pass it to Sudo, right? We don't need it for the release, but would be good to add soon so we don't forget.

[vikasrohit]

Yes, ideal place for the check is in API.

[fnisen]

Can you work on this or does it need to be done by Sudo or Kohata-san?

[vikasrohit]

For API level changes, we need Sudo or Kohata-san.

Update: As we don't have any way to directly reach to pin-verification page, I guess, we can temporarily implement this check in front end as well.

[vic-georgiev]

The whole point of this lock is to make sure no brute-force attacks can happen. @mtwomey something to think about