1

What message should I show to users when there is a problem with his authentication?

I'm developing an application where there are authentications even when user is already logged (on each request/post to server), so for example, if he changes his e-mail address, password or other critical information, his current login will be invalid.

In this case, if he was using his laptop and made those changes his session on his mobile will be invalid. This is where I want to show this message, to provide feedback that his current session is now invalid and he needs to login again.

But I don't want to show an agressive message because I'm afraid of somethings, for example:

  • Make user feels the app is insecure!!!
  • Make user feels like he did something wrong and those changes are now invalid.
  • Feels like the app isn't integrated with all devices and, somehow, instable/insecure.

My first tought was to display a message like: "Your current session is invalid, please login again".

But I don't know what would be a good pratice on this scenario since it envolves security and users personal information.

Improve this question

3 Answers 3

Reset to default
2

I think printing that something went "invalid" is not a good idea, because a user might suppose that something was broken. This will increase pressure on your technical support, plus user may think that the application is not reliable itself.

If you can determine what is the reason that you need to ask for the password again, show message like that:

You have changed your password elsewhere else, and we need to authorize you again.

If you can't determine the particular reason why do you need to authorize person again, show the following message:

For security reasons please provide your credentials again.

Improve this answer
8
  • I think the biggest point from this answer is telling the user they will need to authorize again along with the confirmation of the password change. I would even go as far as telling the user that re-authorization will be required before they even change their authentication data. Let the user know as soon as possible that re-authentication is required. It makes the cause-effect connection with the user, which should prevent that unstable/insecure feeling.
    – Tory
    Oct 3, 2016 at 13:55
  • But using the term "For security reasons" doesn't have the same side effect as using "invalid" term? If i, for example, see a website telling me to do a login again for security reasons, it seems that it's, somehow, insecure.
    – CelsomTrindade
    Oct 3, 2016 at 13:59
  • @Tory in this case, the user will be automatically logged out of the system and will have to provide the credentials again. I just want to tell him why he need to do it without feeling like a problem with the web app itself.
    – CelsomTrindade
    Oct 3, 2016 at 14:02
  • @CelsomTrindade displaying for security reasons is not as harsh term as invalid something. It is for cases when you can't determine why the session become invalid. If there's a better idea, let's know that.
    – user34325
    Oct 3, 2016 at 14:06
  • The only 2 verifications I can do is to check if the whole session is invalid, eg. Malicious user trying to use an invalid access token. Or I can validate if the current data stored on the session is different from the actual data. But I can't determine what data it's. I mean.. I could do that, but would envolve a whole code change I'm not able to do atm.
    – CelsomTrindade
    Oct 3, 2016 at 14:23
1

It is always best to prevent errors from happening by guiding users. You can inform the user when he changes the information, that he will be logged out and after the update, a redirect in the login page can be a good solution.

If you really need to keep that functionality, with the error message, I think "Your current session is invalid" sounds scary. Provide the basic required information, that the user must log in again to solve the problem because changes in his profile were made. Also, you can display a link to the help page.

I think is good practice to let the user know what went wrong and is essential to make clear what’s the next step the user should take to fix the error.

Update: The message could be: "Sorry, you have been logged out [probably in another window or other device]. Please log in again." or "A change in your account required that you sign in again".

Improve this answer
2
  • In this case, I'm already providing the feedback when the user is doing those changes. The "invalid" message I'm talking about, is when he try to access again in another device. If i change the password on my laptop and access on my phone, it will have an invalid session, since I changed the password. But I liked the idea to tell users he will be logged out from all other devices.
    – CelsomTrindade
    Oct 3, 2016 at 14:40
  • @CelsomTrindade I think the message could be this, "Sorry, you have been logged out [probably in another window or other device]. Please log in again." This is what I would use because "Session invalid" may be not clear for the user.
    – Madalina Taina
    Oct 3, 2016 at 17:46
0

From a security perspective you want to keep the error message as generic as possible. Don't write WHAT sort of authentication error has occurred, this is due to the fact that it could be exploited.

For example, say I'm a malicious user who is writing a script that keeps checking a username / password combination on a system that shows EXPLICIT information ("Wrong password", "No user name with that name" etc).

If I know that a user the password is wrong, then the user name is likely to exist and as such I can start guessing the password. If you instead give me a "Incorrect information" prompt, then it I'd have to exhaust my dictionary of passwords before I can move on to the next item in my dictionary of users. Does that make sense? :)

That being said this is one of the most discussed questions in the idea of security / usability.

My personal opinion is to go for the safer way of displaying a generic error, but making sure it doesn't alienate the user or make him / her feel stupid. This makes the UX as pleasant as possible as well as makes sure that the system is safer.

Simply log the user off from any connected devices with a message displaying that critical data has been edited and a re-authorization is required. Either that or open a prompt that requires them to log in / navigate the user to a temporary page that requires a re-authorization before sending them back to where they were.

The changes you made requires a re-authorization. Please enter your credentials.

Improve this answer
1
  • About the first part of your answer (which is for another topic, but.. ) avoid telling what went wrong isn't always the best thing. For example, the user/pass alert, If I want to check if a username exists, I just need to create an account with that username, this way I know the answer and only need to guess the password. But in my case, it may have changed the e-mail, confirmed the e-mail, changed his permissions, etc.. Also there is a malicious user, trying to use an invalid token. Most cases: User changed something. Fewer cases: User is forcing an invalid token.
    – CelsomTrindade
    Oct 3, 2016 at 14:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.