887862 - The 5 minutes PIN lockout is displayed even if users logged in with another persona account.

Status: VERIFIED FIXED

(Marketplace Graveyard :: Payments/Refunds, defect, P2)

Description

[Victor Carciu]

Attachment: Logs

Prerequisites:
Unagi device with MP stage installed

Steps to reproduce:
1.Login to MP stage and try to purchase any paid app
2.When PIN is required, enter an wrong PIN 5 times
3.When the 5 mins pin lockout screen is displayed, sign out and sign in again with a completely new persona account
4.Try to buy an app

Expected results:
Users are asked to create\confirm a new PIN

Actual results:
Pin lockout screen is still displayed.

NOTES:
After 5 minutes the old PIN is still recognized and user can buy without creating a new PIN for 

Please see attached logs

Comment 1

[Victor Carciu]

I just observed that at a subsequent purchase, Create PIN flow started , so the old pin can be used only first time.

Comment 2

[Andy McKay]

See also bug 888036

Comment 3

[Wraithan (Chris McDonald) [:wraithan]]

The sign out/sign in part is in marketplace, not in webpay. I didn't realize that until I tried to actually trigger this bug and realized I couldn't the way I was thinking about it.

What likely needs to happen is we need to initiate a logout in webpay when you logout of marketplace. If we blow away session cookies then you'll be able to log in and we will check your locked status of the newly logged in account.

Comment 4

[Wraithan (Chris McDonald) [:wraithan]]

https://github.com/mozilla/webpay/commit/0937b5a46a7cf1cdd7a5070c24d3cbbbedcdb0fd

Fixed. Now bounces through an intermediary screen to hit persona before redirecting. Slows things down slightly but is the best solution for now.

Comment 5

[Victor Carciu]

This is still reproducible on Stage. I was not able to grab logs with "submit logs" feature, but the issue is reproducible exactly as described in original scenario.

Comment 6

[Wraithan (Chris McDonald) [:wraithan]]

This was landed after stage updated yesterday. As of Noon PST today, stage will update with this patch.

Comment 7

[Victor Carciu]

Verified as fixed. Users were asked for PIN after switching to another account.