gioboa / jira-plugin

Jira plugin for VsCode
https://marketplace.visualstudio.com/items?itemName=gioboa.jira-plugin
MIT License
266 stars 41 forks source link

issue: User Password change causes mass failed login attempts and locks account #137

Closed JaydenMaalouf closed 4 years ago

JaydenMaalouf commented 4 years ago

Describe the issue If a user ever changes their password (via AD or Jira) - the plugin will not pick up that there has been a change and will attempt to login several times. We experienced about 600 attempts over the over the course of 24hours for a single account.

To Reproduce Steps to reproduce the behavior:

  1. Setup Jira for VS
  2. Use it as normal
  3. Update user password (in our case - via AD)
  4. Watch the user's login attempts sky rocket and the account to be locked out

Expected behavior A failed login attempt should prompt the user to re-authenticate with Jira.

Screenshots image

Desktop (please complete the following information): Jira v8.5.1

Log

2019-12-09 09:06:25,839 http-nio-8095-exec-1378 anonymous 546x372157x1 - ***.***.**.***,**.***.***.*** /rest/api/2/field login : '**********' tried to login but they do not have USE permission or weren't found. Deleting remember me cookie.
2019-12-09 09:06:25,870 http-nio-8095-exec-1378 anonymous 546x372157x1 - ***.***.**.***,**.***.***.*** /rest/api/2/field The user '**********' has FAILED authentication.  Failure count equals 1
2019-12-09 09:06:25,885 http-nio-8095-exec-1378 anonymous 546x372157x1 - ***.***.**.***,**.***.***.*** /rest/api/2/field login : '**********' tried to login but they do not have USE permission or weren't found. Deleting remember me cookie.
2019-12-09 09:06:25,917 http-nio-8095-exec-1378 anonymous 546x372157x1 - ***.***.**.***,**.***.***.*** /rest/api/2/field The user '**********' has FAILED authentication.  Failure count equals 2
......
2019-12-09 11:26:25,382 http-nio-8095-exec-1370 anonymous 686x403843x2 - ***.***.**.***,**.***.***.*** /rest/api/2/field The user '**********' is required to answer a CAPTCHA elevated security check.  Failure count equals 58
......
gioboa commented 4 years ago

Hi, thanks for your feedback. The plugin don't retry after a failed login, anyway I will check the code. :+1:

gioboa commented 4 years ago

I can't reproduce the problem.