Details
-
Task
-
Resolution: Unresolved
-
Major
-
None
-
11.10.13
-
Unknown
-
Description
The manual test is here: Authentication security module CAPTCHA
Existing automated coverage
- LoginProtectionIT#repeatedAuthenticationFailure: with failureStrategy=captcha, 3 attempts, 300s window (set via addObject): 3 wrong logins trigger the CAPTCHA, and the correct password without a CAPTCHA is refused
- DefaultAuthenticationFailureManagerTest#authenticationFailureLimitReached: unit: failure strategies are triggered when the max attempts are reached in the time window
Missing automated coverage
- As admin, go to Administer Wiki > Users & Rights > Authentication, select "CAPTCHA" in Failure Strategies and Save (no page object exists for this section); assert the configuration is saved
- After 3 failed logins, fill the username, the correct password and the correct CAPTCHA answer, click Log-in and assert the user is logged in (needs a deterministic/test CAPTCHA)
Suggested location: xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-test/xwiki-platform-flamingo-skin-test-docker/src/test/it/org/xwiki/flamingo/test/docker/LoginProtectionIT.java
Found by comparing the XWiki 18.4.4 manual test runs against the automated tests on master (a0055f10a1a).