The beforeLogin hook will not be triggered when attempting to log in with an incorrect password.

[tooodooo]

New Issue Checklist

• Report security issues confidentially.
• Any contribution is under this license.
• Before posting search existing issues.

Issue Description

I want to use beforeLogin to implement the functionality of locking a user's account for 10 minutes if the number of login failures exceeds 3 times. However, the beforeLogin hook is not triggered when the password is incorrect, and it is triggered successfully only when the password is correct.

Steps to reproduce

The beforeLogin hook will not be triggered when attempting to log in with an incorrect password.

Actual Outcome

{ "code": 101, "error": "Invalid username/password." }

Expected Outcome

beforeLogin should be triggered!?

Environment

docker with cloud code support

Server

• Parse Server version: 7.3.0
• Operating system: MacOS
• Local or remote host (AWS, Azure, Google Cloud, Heroku, Digital Ocean, etc): Local

Database

• System (MongoDB or Postgres): MongoDB
• Database version: lastest
• Local or remote host (MongoDB Atlas, mLab, AWS, Azure, Google Cloud, etc): Local

Client

• SDK (iOS, Android, JavaScript, PHP, Unity, etc): Flutter
• SDK version: 9.0.0

Logs

[1] parse-server running on http://localhost:1337/parse
error: Invalid username/password. {"code":101,"stack":"Error: Invalid username/password.\n at /parse-server/lib/Routers/UsersRouter.js:135:17"}

[parse-github-assistant]

Thanks for opening this issue!

• 🚀 You can help us to fix this issue faster by opening a pull request with a failing test. See our Contribution Guide for how to make a pull request, or read our New Contributor's Guide if this is your first time contributing.

[mman]

Any reason why built in configuration to achieve account locking is not working for you? (https://github.com/parse-community/parse-server?tab=readme-ov-file#password-and-account-policy)

[tooodooo]

Great, there are so many configuration options left. I'll give it a try. Thank you！

[mtrezza]

It's still a good point, maybe we could add a new afterFailedLogin trigger? Or should such a customization be rather implemented as a custom auth adapter, even if it's for username & password? @dblythy what do you think? Is there currently a way to easily add a custom action on failed login attempt?

[tooodooo]

Any reason why built in configuration to achieve account locking is not working for you? (https://github.com/parse-community/parse-server?tab=readme-ov-file#password-and-account-policy)

I tried to set up the account lockout policy. Here are the environment variables I configured in my docker-compose.yml:

• PARSE_SERVER_ACCOUNT_LOCKOUT_DURATION=5
• PARSE_SERVER_ACCOUNT_LOCKOUT_THRESHOLD=3
• PARSE_SERVER_ACCOUNT_LOCKOUT_UNLOCK_ON_PASSWORD_RESET=true

docker-compose down
docker-compose up -d

However, it did not work. Did I make any mistakes?

[mtrezza]

For help with Parse Platform we recommend our community forum or our community chat. I'll go ahead and close this thread as the original question has been addressed, i.e. the behavior is as expected. If the built-in feature is not enough for your use case, then I'd suggest to open a new issue with a feature request where you describe the functionality you would like to see.