As a system administrator,
I need the front-end login form to be able to post user login credentials to the server for validation and authorisation
So that a user can be authenticated.
It is acceptable when...
The POST message sent to the server contains the following data:
Email address
Password
Validation is performed on the data sent
If the email address and the password do not match the same account then:
The system pauses for 1 second, or longer. (This is to slow down brute-force attacks)
The system checks if the number of failed password attempts since the last successful login has been breached.
If the number of failed attempts has been breached then the account is locked
A 400 Bad Request is returned with a generic message of "Could not log you in with the supplied details". Do not provide specific details in the message for example the email address is correct but the password is incorrect, as this can help hackers in brute-force attacks.
If the email address and the password match an account then
The system logs the successful login attempt
The system logs the login attempt to an audit table with the email address, the date and time of login, and the IP Address
The email address and IP Address is for the purpose of banning in the future if required.
A 200 Success is returned with the ID of the account.
As a system administrator, I need the front-end login form to be able to post user login credentials to the server for validation and authorisation So that a user can be authenticated.
It is acceptable when...
View login logic flow diagram