Too many failed logins - more info needed on error message

[nlhkabu]

Currently we have messages that say:

"There have been too many unsuccessful login attempts. Please try again later."

this would be better usability if we could tell the user how long they will be locked out for...

e.g.

"There have been too many unsuccessful login attempts. You have been locked out for 60 minutes. Please try again later."

As far as I can tell, we need to update this in two places:

https://github.com/pypa/warehouse/blob/2ac60aeb0caf4b22ea1d70fae72ac2182a1626cb/warehouse/accounts/views.py#L37

https://github.com/pypa/warehouse/blob/c1c219d731e19b226395287623856d107456f565/warehouse/accounts/forms.py#L114

@dstufft - what is the 'locked out' time?

[dstufft]

Are you asking how to determine how long it will be? If so there is an attribute on the TooManyFailedLogins exception called resets_in which is a standard Python datetime.timedelta object (See https://docs.python.org/3.6/library/datetime.html#datetime.timedelta).

You can easily get the number of seconds using total_seconds() on that object, trying to convert that to a more human readable thing than just N seconds will require additional code I think.

[nlhkabu]

I don't really need anything too specific. Just something like "You will be locked out for approximately 30 minutes..." would do.

[dstufft]

FWIW our current policy the max lock out time I think is going to be right around 5 minutes, that could be adjusted though in the future. It might be good enough to just use seconds?

[nlhkabu]

I'd rather put "approximately 5 minutes" than "300 seconds", because it means more to the user.

Could we add a comment in the code to say "if you change this, you need to change the message"? or is that a bit clunky?

[dstufft]

We can add a comment to the code yea, we also already have javascript support for relative datetimes, so we could convert the timedelta to an absolute datetime and then let the JS bit render it. Alternatively we could use something like https://pypi.org/project/humanize/ to do humanize.naturaltime(exc.resets_in).

[nlhkabu]

If we already have JS support for this, then lets take this approach.
If you can point me in the direction of the relevant lines, I can make a PR :)

[dstufft]

https://github.com/pypa/warehouse/blob/master/warehouse/templates/packaging/detail.html#L94-L96 is where we've used it previously. That's using a datetime not a timedelta so you'll need to convert the timedelta to a datetime but just emitting that HTML should have the JS pick it up automatically.