FR: successful password reset should unlock account locked via accountLockout policy

[mman]

Running parse server 4.2.0 with accountLockout policy configured to enable locking accounts when incorrect password is entered multiple times.

What I found out is that when a user gets locked out due to many failed login attempts, and then performs a password reset successfully, the account remains locked.

I thinks a successful password reset should unlock the account.

What do you think?
Martin

[mtrezza]

I think it makes sense. I just tried out Twitter's account lock policy and it works the way you describe:

• The account is locked after n retries.
• Even entering the correct password does not unlock the account.
• Password reset via email works, unlocks the account and allows to login immediately.

However, this is a matter of policy, which can be different depending on the use case of Parse Server. In some systems, a locked account cannot be unlocked by a user anymore and does not unlock itself, only an admin can unlock the account.

I think it would be a good enhancement and suggest to add this as an option to the Parse Server configuration.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[mman]

This should remain open

[mtrezza]

The PR above introduces an option to define this behavior. The PR is currently in review.