[Bug][Login][US3370] Lockout message does not match UC1 acceptance criterion

[JulietaTz]

Bug Issue – Login / Account Lockout

Title

[Bug]: Login – Lockout message does not match acceptance criterion

Context

• User Story: US3370 – Login enhancement / Locked User
• The user should be locked after 3 consecutive failed login attempts.
• According to UC1, the following message should be displayed after the account is locked:

User is locked - Login not possible!

• During manual testing in Firefox, the lockout functionality worked, but a different message was displayed.

Problem Statement

• The account is locked as expected.
• The displayed lockout message does not match the message defined in UC1.
• This creates a mismatch between the requirement and the implemented behavior.

Steps to Reproduce

1. Open the Toolshop login page.
2. Enter a registered user e-mail.
3. Enter a wrong password.
4. Repeat until 3 consecutive failed login attempts have been made.
5. Try to log in again with the same e-mail and a wrong password.
6. Observe the displayed message.

Expected Result

According to US3370 / UC1, the following message should be displayed:

User is locked - Login not possible!

The user should remain on the login screen.

Actual Result

The account is locked and the user remains on the login screen, but the following message is displayed:

Account locked, too many failed attempts. Please contact the administrator.

Test Result

FAIL

The lockout functionality works, but the displayed message does not match the acceptance criterion.

Environment

• Application: Toolshop
• Feature: Login / Account Lockout
• Browser: Firefox
• User Story: US3370
• Test User: tester@mail.at

Evidence

Screenshot from manual test execution in Firefox.

Actual message:

Account locked, too many failed attempts. Please contact the administrator.

Expected message according to US3370 / UC1:

User is locked - Login not possible!

Impact

• The account lockout functionality itself works.
• However, the implementation does not fully match the acceptance criterion.
• Manual or automated tests that validate the exact expected message may fail.
• Requirement-to-implementation traceability is affected.
• The user receives different information than specified in the user story.

Risk

Low to Medium

The core authentication security behavior works correctly, but the displayed user-facing message does not match the requirement.

Suggested Fix

Align the displayed lockout message with US3370 / UC1.

Expected message:

User is locked - Login not possible!

Alternatively, if the current message is intentional, update US3370 / UC1 so that the requirement matches the implemented behavior.

Acceptance Criteria

• After 3 consecutive failed login attempts, the user account is locked.
• The user remains on the login screen.
• The displayed lockout message matches the agreed requirement.
• If the current message is intended, the user story and acceptance criterion are updated accordingly.

Related Information

User Story:
https://github.com/testsmith-io/practice-software-testing/blob/main/sprint5-with-bugs/testSessions/userStories/us3370-login-locked-account.md

Known V5 Bug List:
https://github.com/testsmith-io/practice-software-testing/blob/main/sprint5-with-bugs/testSessions/listOfBugs.md