aws-amplify / amplify-android

The fastest and easiest way to use AWS from your Android app.
https://docs.amplify.aws/lib/q/platform/android/
Apache License 2.0
237 stars 111 forks source link

confirmResetPassword returns generic error message if incorrect verificationCode is provided. #2866

Open ashwani-trivediat opened 3 days ago

ashwani-trivediat commented 3 days ago

Before opening, please confirm:

Language and Async Model

Kotlin

Amplify Categories

Authentication

Gradle script dependencies

```groovy // Put output below this line implementation 'com.amplifyframework:aws-api:2.19.1' ```

Environment information

``` # Put output below this line ------------------------------------------------------------ Gradle 8.0 ------------------------------------------------------------ Build time: 2023-02-13 13:15:21 UTC Revision: 62ab9b7c7f884426cf79fbedcf07658b2dbe9e97 Kotlin: 1.8.10 Groovy: 3.0.13 Ant: Apache Ant(TM) version 1.10.11 compiled on July 10 2021 JVM: 17.0.9 (JetBrains s.r.o. 17.0.9+8-b1166.2) OS: Mac OS X 14.4.1 x86_64 ```

Please include any relevant guides or documentation you're referencing

https://docs.amplify.aws/gen1/android/build-a-backend/auth/manage-passwords/#reset-password

Describe the bug

Amplify SDK authentication version 2.19.1 seems to throw and generic error message if user types incorrect verificationCode while trying to reset password. Here are the steps:

  1. User request a verification code by calling:
    Amplify.Auth.resetPassword(
    "username",
    result -> Log.i("AuthQuickstart", result.toString()),
    error -> Log.e("AuthQuickstart", error.toString())
    );
  2. User types incorrect verificationCode and new password and re-enters new password, and call amplify SDK confirmResetPassword method:
    Amplify.Auth.confirmResetPassword(
    "Username",
    "NewPassword123",
    "confirmation code you received",
    () -> Log.i("AuthQuickstart", "New password confirmed"),
    error -> Log.e("AuthQuickstart", error.toString())
    );
  3. Following error message is displayed to the user: Screenshot_20240627_145355_Plumsense_Dev-20240627-095915

On investigating the root cause it appears that inside RealAWSCognitoAuthPlugin whenever any type of error is encountered a generic error message is returned, here is the message: "There is a possibility that there is a bug if this error persists. Please take a look at \n" + "https://github.com/aws-amplify/amplify-android/issues to see if there are any existing issues that \n" + "match your scenario, and file an issue with the details of the bug if there isn't."; Following appears to be problematic code:

Screenshot 2024-06-30 at 11 39 29 PM

Reproduction steps (if applicable)

No response

Code Snippet

// Put your code below this line.

Log output

``` // Put your logs below this line ```

amplifyconfiguration.json

No response

GraphQL Schema

```graphql // Put your schema below this line ```

Additional information and screenshots

No response

mattcreaser commented 2 days ago

The described steps are supposed to result in a CodeMismatchException from Kotlin SDK. We will have to check if it is returning an incorrect exception type.

ashwani-trivediat commented 1 day ago

I looked into the error a bit more, looks like there is CodeMismatchException in the headers.

Screenshot 2024-07-03 at 9 25 21 PM

Here is the stack trace:

Screenshot 2024-07-03 at 9 23 08 PM

Error message is as follows: {AttributeKey(aws.smithy.kotlin#ProtocolResponse)=DefaultHttpResponse(status=400: Bad Request, headers=aws.smithy.kotlin.runtime.http.engine.okhttp.OkHttpHeadersAdapter@f2c480f, body=aws.smithy.kotlin.runtime.http.content.ByteArrayContent@e69709c)}

aws.sdk.kotlin.services.cognitoidentityprovider.model.CognitoIdentityProviderException: Failed to parse response as 'awsJson1_1' error

Hope it helps.