Bug 30088 - Improve forgotten password form to be more obvious that only one field must be filled out
Summary: Improve forgotten password form to be more obvious that only one field must b...
Status: Failed QA
Alias: None
Product: Koha
Classification: Unclassified
Component: OPAC (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement
Assignee: Owen Leonard
QA Contact: Laura Escamilla
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2022-02-13 01:46 UTC by Christopher Brannon
Modified: 2025-01-23 18:32 UTC (History)
3 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments
An idea (97.66 KB, image/gif)
2022-05-05 16:12 UTC, Owen Leonard
Details
Bug 30088: Improve forgotten password form to be more obvious that only one field must be filled out (10.63 KB, patch)
2024-06-11 17:39 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 30088: Improve forgotten password form to be more obvious that only one field must be filled out (10.67 KB, patch)
2024-06-12 19:25 UTC, Sam Lau
Details | Diff | Splinter Review
Bug 30088: (follow-up) Improve behavior when email is ambiguous (7.88 KB, patch)
2024-08-07 18:52 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 30088: Improve forgotten password form to be more obvious that only one field must be filled out (10.74 KB, patch)
2024-09-19 19:46 UTC, Laura Escamilla
Details | Diff | Splinter Review
Bug 30088: (follow-up) Improve behavior when email is ambiguous (7.95 KB, patch)
2024-09-19 19:46 UTC, Laura Escamilla
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Christopher Brannon 2022-02-13 01:46:58 UTC
Two thoughts:
Is there a reason patrons have to be presented with two fields, one for login or one for e-mail address?  The prompt says to enter one or the other.  Since there is the possibility for more than one account to have the same e-mail address, should we only ask for the username?

The second thought is, should Koha e-mail the account user if a request has been made to reset the password?  This seems to be common practice these days.
Comment 1 Katrin Fischer 2022-02-13 09:50:55 UTC
I think the idea is that the user can pick what they know/have on hand, which varies with different use cases. The email AND the login are only required if there are users with the same email address. I think often it's easier for users to give their institutional email than a cardnumber/userid.

For your second question I am not sure: the user is always emailed in this process?
Comment 2 Christopher Brannon 2022-02-14 17:46:57 UTC
Oh, yeah!  I'm having problems with ideas, apparently.  Of course they already get an e-mail.

As far as the two lines go, I guess perhaps it should be reworded, or maybe guided?  Even though it says to enter either, it looks like you should enter both.  Maybe it should start with picking one, then prompting for the info.  Then if it needs more (in the case of the e-mail address being detected on more than one account) it should ask for a username.  That might make it a little more clear.

It just seems if you present patrons with an option to use either, and then go for the e-mail, and they actually need both, then they are going to get frustrated or give up.
Comment 3 Katrin Fischer 2022-02-14 20:33:12 UTC
I like the idea of making the 'pick one' more obvious. I am rewording the description a little to make that stand out.
Comment 4 Christopher Brannon 2022-02-15 15:25:24 UTC
Thanks for helping me work this out, and listening.  Sometimes it isn't easy to put a finger on, and I have to think a little more about what is going on.  :)
Comment 5 Katrin Fischer 2022-02-19 13:29:41 UTC
My pleasure - I have no problem throwing ideas around and love learning about use cases (hence often asking a lot of questions I guess)
Comment 6 Owen Leonard 2022-05-05 16:12:59 UTC
Created attachment 134654 [details]
An idea
Comment 7 Christopher Brannon 2022-05-05 18:35:24 UTC
That looks very nice!
Comment 8 Katrin Fischer 2022-05-06 11:02:14 UTC
Agreed!

How do we handle the case with multiple users having the same email? (it will ask for username then)
Comment 9 Mirjam Vantieghem 2024-05-16 09:49:44 UTC
+1 We are sometimes having zealous patrons filling out both fields (when not necessary) and failing to set their password. It would be nice to have this changed to something like what Owen created.
Comment 10 Owen Leonard 2024-06-11 17:39:09 UTC
Created attachment 167642 [details] [review]
Bug 30088: Improve forgotten password form to be more obvious that only one field must be filled out

This patch updates the OPAC's forgotten password form so that the form
fields are initially hidden. The user clicks on "I know my login" or "I
know my email address" to display the relevant form field.

To test, apply the patch and go to Administration to make sure the
"OpacResetPassword" preference is enabled.

- In the OPAC, click the "Forgot your password?" link on the home page.
- Test the two buttons, "I know my login" and "I know my email address."
  Each should display the correct parts of the form.
- Try submitting an email address which has been set to more than one
  patron.
  - You should get an error message, "Account identification with this
    email address only is ambiguous."
  - Both form fields should be visible.

Sponsored-By: Athens County Public Libraries
Comment 11 Sam Lau 2024-06-12 19:25:46 UTC
Created attachment 167675 [details] [review]
Bug 30088: Improve forgotten password form to be more obvious that only one field must be filled out

This patch updates the OPAC's forgotten password form so that the form
fields are initially hidden. The user clicks on "I know my login" or "I
know my email address" to display the relevant form field.

To test, apply the patch and go to Administration to make sure the
"OpacResetPassword" preference is enabled.

- In the OPAC, click the "Forgot your password?" link on the home page.
- Test the two buttons, "I know my login" and "I know my email address."
  Each should display the correct parts of the form.
- Try submitting an email address which has been set to more than one
  patron.
  - You should get an error message, "Account identification with this
    email address only is ambiguous."
  - Both form fields should be visible.

Sponsored-By: Athens County Public Libraries
Signed-off-by: Sam Lau <samalau@gmail.com>
Comment 12 Laura Escamilla 2024-08-06 12:09:45 UTC
I love the button additions! There's just one small issue. In step 3, when you get the following error:

"Account identification with this email address only is ambiguous.
Please use the field 'Login' as well."

It contradicts the "To reset your password, enter your login or your email address." which is still visible. We should remove this message if the new error pops up.
Comment 13 Owen Leonard 2024-08-07 18:52:04 UTC
Created attachment 170146 [details] [review]
Bug 30088: (follow-up) Improve behavior when email is ambiguous

This patch makes a few changes to the way the form appears when you
submit an email which is attached to more than one patron account.

Apply the patch and rebuild the OPAC CSS.

- If you submit an email address which isn't unique, the "enter your
  login or your email address" message is hidden.
- The login and email fields are marked as required.

This patch also changes the behavior of the "I know my..." buttons
so that they change style when clicked.
Comment 14 Laura Escamilla 2024-09-19 19:46:06 UTC
Created attachment 171802 [details] [review]
Bug 30088: Improve forgotten password form to be more obvious that only one field must be filled out

This patch updates the OPAC's forgotten password form so that the form
fields are initially hidden. The user clicks on "I know my login" or "I
know my email address" to display the relevant form field.

To test, apply the patch and go to Administration to make sure the
"OpacResetPassword" preference is enabled.

- In the OPAC, click the "Forgot your password?" link on the home page.
- Test the two buttons, "I know my login" and "I know my email address."
  Each should display the correct parts of the form.
- Try submitting an email address which has been set to more than one
  patron.
  - You should get an error message, "Account identification with this
    email address only is ambiguous."
  - Both form fields should be visible.

Sponsored-By: Athens County Public Libraries
Signed-off-by: Sam Lau <samalau@gmail.com>
Signed-off-by: Laura_Escamilla <laura.escamilla@bywatersolutions.com>
Comment 15 Laura Escamilla 2024-09-19 19:46:09 UTC
Created attachment 171803 [details] [review]
Bug 30088: (follow-up) Improve behavior when email is ambiguous

This patch makes a few changes to the way the form appears when you
submit an email which is attached to more than one patron account.

Apply the patch and rebuild the OPAC CSS.

- If you submit an email address which isn't unique, the "enter your
  login or your email address" message is hidden.
- The login and email fields are marked as required.

This patch also changes the behavior of the "I know my..." buttons
so that they change style when clicked.

Signed-off-by: Laura_Escamilla <laura.escamilla@bywatersolutions.com>
Comment 16 Laura Escamilla 2024-09-19 19:46:43 UTC
QA tool was happy and everything looks good. Passing QA here. Thanks, Owen!
Comment 17 Katrin Fischer 2024-10-18 15:28:12 UTC
I have no luck testing this :(

1) I have set up 2 accounts with the same email address and try to reset my password using the email. 

I get:
An error occurred while sending you the password recovery link. 
Please try again later.

Could you please run through this again and double check?

2) I feel that the text on the buttons is maybe a little bit on the big side compared to the fonts on the rest of the page. yarn build has been run.
Comment 18 Klas Blomberg 2025-01-20 09:42:34 UTC
I don't want to be a party-pooper, but we are contemplating to file a bug for making both email and userID mandatory

The background for this:
There has been a series of frauds in Sweden where the impostors have used the password recovery feature to deceive elderly people (80+ years)

All swedish libraries use the equivalent to social security numbers as userID.
The impostors have somehow got a list of social security numbers, and enters them one after another in password recovery.
When they see that an email is sent they call the patron, saying they are calling form the library and wants to help them with their password-problem 
The patron gets confused and is asked to open his/her electronicID - and if they do the impostors use it to transfer money from their bank-account.
One patron in a suburb to Stockholm lost 40000€ this way. Therefore we think it's too easy to recover passwords in the opac.

By making both email and userID mandatory frauds like this will be next to impossible
Comment 19 Katrin Fischer 2025-01-20 10:58:48 UTC
(In reply to Klas Blomberg from comment #18)
> I don't want to be a party-pooper, but we are contemplating to file a bug
> for making both email and userID mandatory
> 
> The background for this:
> There has been a series of frauds in Sweden where the impostors have used
> the password recovery feature to deceive elderly people (80+ years)
> 
> All swedish libraries use the equivalent to social security numbers as
> userID.
> The impostors have somehow got a list of social security numbers, and enters
> them one after another in password recovery.
> When they see that an email is sent they call the patron, saying they are
> calling form the library and wants to help them with their password-problem 
> The patron gets confused and is asked to open his/her electronicID - and if
> they do the impostors use it to transfer money from their bank-account.
> One patron in a suburb to Stockholm lost 40000€ this way. Therefore we think
> it's too easy to recover passwords in the opac.
> 
> By making both email and userID mandatory frauds like this will be next to
> impossible

Hi Klas, that's a real bad story. I am sorry to hear. I think requiring userid (with it accepting either cardnumber or username) + email would be OK for us. With your argument I am not sure if it needs to be configurable.
Comment 20 Owen Leonard 2025-01-22 13:27:26 UTC
I think this is also a good argument for NOT giving any indication whether a particular user id has been found. In my experience on other web sites the user would get a message like "If you have an account you will get an email."
Comment 21 Christopher Brannon 2025-01-23 18:13:42 UTC
This may be something that needs to be addressed in another bug, but what about patrons that don't use email?  Shouldn't there be a process for SMS as well?
Comment 22 Owen Leonard 2025-01-23 18:32:10 UTC
(In reply to Christopher Brannon from comment #21)
> what about patrons that don't use email?  Shouldn't there
> be a process for SMS as well?

That would also be a separate bug.