entering a recovery code should give feedback [#2483555]

I just tried entering a recovery code using a browser I'd not authenticated with.

It didn't give me any errors and took me to my account page. Does that mean it worked?

The form should output a message to confirm the code has been successful.

Comment	File	Size	Author
#5	2483555-5-recovery-code-ui-feedback.patch	1.19 KB	banviktor
#5

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

Comment #1

greggles

he/him

English

Denver, Colorado, USA

CreditAttribution: greggles commented 5 May 2015 at 21:53

Title:	entering a recovery code doesn't give any feedback	» entering a recovery code should give feedback
Category:	Bug report	» Feature request

Can you suggest some copy?

Feels like a feature and re-stating the title to be a statement of what to do instead of what not to do.

Comment #2

joachim CreditAttribution: joachim commented 6 May 2015 at 05:49

Submitting a form should give feedback -- I thought that was a standard UX principle.

Not giving feedback leaves the user confused as to whether their action was successful or not. Therefore this is a UX bug.

> Can you suggest some copy?

'The recovery code has been validated. You are now authenticated.'

Comment #3

greggles

he/him

English

Denver, Colorado, USA

CreditAttribution: greggles commented 6 May 2015 at 13:28

Submitting a form should give feedback -- I thought that was a standard UX principle.

Is there an issue in core to add feedback from submitting the login form? Because it doesn't give any explicit feedback of the kind you mention.

TFA login is a new flow, but it's fundamentally part of logging in. The feedback that you have succeeded in logging in is that you are logged in.

If anything I think it's worth mentioning that the recovery codes are one-time-use and that the code they've just used cannot be used again. But saying "That worked, you are logged in" feels redundant to the fact that the UI has changed dramatically and the person is logged in.

Comment #4

banviktor CreditAttribution: banviktor at CARD.com commented 15 December 2015 at 15:32

Status:

Active

» Needs work

I agree with @greggles that the fact of a recovery code validation doesn't need any special feedback.
However I think it would be nice to inform the user about how many remaining codes they have and if they just used up their last one give a link too to the setup page.