When using lockable, failed_attempts is incremented by two after failed login attempt about devise-two-factor HOT 9 OPEN

I'm facing the same issue as well. Our hacky fix was just to double the maximum_attempts to what we really want. (ie. we want to lock after 10 failed attempts, so we set maximum_attempts to 20)

from devise-two-factor.

Any progress? Been hitting a wall and was wondering if it was me or devise or devise-two-factor

from devise-two-factor.

When using lockable devise increments the failed_attempts counter by one right in the beginning of the authentication even though the authentication has not yet failed nor succeed.
It happens in lib/devise/models/lockable.rb method valid_for_authentication?

from devise-two-factor.

To be more accurate it is the current_user and user_signed_in? helpers that are trying to authenticate the user from the request data. If none of those helpers are called during the authentication action then the failed_attempts counter is not increased.

from devise-two-factor.

@ShaneWilton could you look at this when you get a chance? This is a rather tricky bug.

from devise-two-factor.

@mwalsher, @mmustala, @ShaneWilton
guys, any update on that?

from devise-two-factor.

Two years elapsed, any progress?

from devise-two-factor.

another issue #127 still not fixed :(

from devise-two-factor.

Any update on this issue? I've been doubling the maximum_attempts to hack my way in as @StevenJL.

from devise-two-factor.