As an existing user,
I want to be able to log into the system,
So that I have access to the member-only features.
It is acceptable when...
There is a screen which allows the user to log into the system.
The screen contains the following mandatory fields:
Email address
Password
The screen contains a Log In button.
The screen contains a Lost Password link
Clicking this link will take the user to the lost password screen (may be a placeholder screen).
The screen contains a Register link
Clicking this link will take the user to the registration screen (may be a placeholder screen).
Clicking the Log In button will trigger form field validation
If validation passes then the form data will be sent to the server via the user login API
If a successful response is returned from the API then the user is redirected to their profile page
If an unsuccessful response is returned from the API then the user is shown a message advising the login failed. Specific reasons are NOT given. This is because a specific reason can help a hacker who is brute forcing.
If the validation fails, a message will be displayed informing the user there are issues with their form, and each field that fails validation will display a warning.
The password must be hashed and salted before storing in the data store, as per Microsoft's recommended approach for ASP.Net authorisation and authentication practices
As an existing user, I want to be able to log into the system, So that I have access to the member-only features.
It is acceptable when...
View login logic flow diagram