From e4fa690df4a333751da6091677a0f3a1cfacf057 Mon Sep 17 00:00:00 2001
From: Malick Diarra <malick.diarra@gsa.gov>
Date: Mon, 8 Jul 2024 12:51:37 -0400
Subject: [PATCH 01/13] changelog: Upcoming Features, Authentication, Recaptcha
 Sign in

---
 .../security_check_failed_controller.rb       |  8 ++++++
 app/controllers/users/sessions_controller.rb  |  3 +--
 .../security_check_failed_presenter.rb        | 12 +++++++++
 app/services/analytics_events.rb              |  4 +++
 app/views/security_check_failed/show.html.erb | 27 +++++++++++++++++++
 config/locales/en.yml                         |  8 ++++++
 config/routes.rb                              |  2 ++
 7 files changed, 62 insertions(+), 2 deletions(-)
 create mode 100644 app/controllers/security_check_failed_controller.rb
 create mode 100644 app/presenters/security_check_failed_presenter.rb
 create mode 100644 app/views/security_check_failed/show.html.erb

diff --git a/app/controllers/security_check_failed_controller.rb b/app/controllers/security_check_failed_controller.rb
new file mode 100644
index 00000000000..078484c1891
--- /dev/null
+++ b/app/controllers/security_check_failed_controller.rb
@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+class SecurityCheckFailedController < ApplicationController
+  def show
+    @presenter = SecurityCheckFailedPresenter.new
+    analytics.security_check_failed_visited
+  end
+end
diff --git a/app/controllers/users/sessions_controller.rb b/app/controllers/users/sessions_controller.rb
index 159e784baf2..021cb12ca6e 100644
--- a/app/controllers/users/sessions_controller.rb
+++ b/app/controllers/users/sessions_controller.rb
@@ -99,10 +99,9 @@ def valid_captcha_result?
     end
 
     def process_failed_captcha
-      flash[:error] = t('errors.messages.invalid_recaptcha_token')
       warden.logout(:user)
       warden.lock!
-      redirect_to root_url
+      redirect_to security_check_failed_url
     end
 
     def recaptcha_form_args
diff --git a/app/presenters/security_check_failed_presenter.rb b/app/presenters/security_check_failed_presenter.rb
new file mode 100644
index 00000000000..ef73aa2385f
--- /dev/null
+++ b/app/presenters/security_check_failed_presenter.rb
@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+class SecurityCheckFailedPresenter
+  def troubleshooting_options
+    [
+      BlockLinkComponent.new(
+        url: MarketingSite.contact_url,
+        new_tab: true,
+      ).with_content(I18n.t('security_check_failed.contact', app_name: APP_NAME)),
+    ]
+  end
+end
diff --git a/app/services/analytics_events.rb b/app/services/analytics_events.rb
index caecbcde27d..3affe6a928c 100644
--- a/app/services/analytics_events.rb
+++ b/app/services/analytics_events.rb
@@ -5403,6 +5403,10 @@ def second_mfa_reminder_visit
     track_event('Second MFA Reminder Visited')
   end
 
+  def security_check_failed_visited
+    track_event(:security_check_failed_visited)
+  end
+
   # Tracks when security event is received
   # @param [Boolean] success Whether form validation was successful
   # @param [String] error_code
diff --git a/app/views/security_check_failed/show.html.erb b/app/views/security_check_failed/show.html.erb
new file mode 100644
index 00000000000..8ea96e856e0
--- /dev/null
+++ b/app/views/security_check_failed/show.html.erb
@@ -0,0 +1,27 @@
+<% self.title = t('security_check_failed.title') %>
+
+<%= render AlertIconComponent.new(icon_name: :warning, class: 'display-block margin-bottom-4') %>
+<%= render PageHeadingComponent.new.with_content(t('security_check_failed.title')) %>
+<p>
+  <%= t('security_check_failed.details_html') %>
+  <%= new_tab_link_to(
+        t('security_check_failed.learn_more'),
+        help_center_redirect_path(
+          category: 'trouble-signing-in',
+          article: 'security-check-failed',
+        ),
+      ) %>
+</p>
+
+<ul class="usa-list margin-top-0">
+  <li><%=  t('security_check_failed.info_p1') %></li>
+  <li><%= link_to(
+        t('security_check_failed.info_p2_link'),
+        login_piv_cac_url
+      ) + " "+ t('security_check_failed.info_p2_part2') %></li> 
+  <li><%=  t('security_check_failed.info_p3') %></li> 
+</ul>
+
+<%= render 'two_factor_authentication/troubleshooting_options', presenter: @presenter %>
+
+<%= render 'shared/cancel', link: root_url %>
\ No newline at end of file
diff --git a/config/locales/en.yml b/config/locales/en.yml
index 27e0a67d630..36e9288fa2d 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -1471,6 +1471,14 @@ risc.security_event.errors.typ_error: typ header must be %{expected_typ}
 saml_idp.auth.error.title: Error
 saml_idp.shared.saml_post_binding.heading: Submit to continue
 saml_idp.shared.saml_post_binding.no_js: JavaScript seems to be turned off in your browser. Normally this step happens automatically, but because you have JavaScript turned off, please click the submit button to continue signing in or signing out.
+security_check_failed.details_html: We don’t recognize the device or browser you’re signing in from.
+security_check_failed.info_p1: 'Use the same device and browser you created your Login.gov account with.'
+security_check_failed.info_p2_link: Try signing in with your government employee ID
+security_check_failed.info_p2_part2: if you are a government employee.
+security_check_failed.info_p3: Turn off any VPN, ad blockers, and clear your cache.
+security_check_failed.learn_more: Learn more about Login.gov’s security checks
+security_check_failed.title: Security check failed
+security_check_failed.contact: Contact %{app_name} support
 service_providers.errors.generic_sp_name: This agency
 service_providers.errors.inactive.button_text: View my %{app_name} account
 service_providers.errors.inactive.heading: '%{sp_name} no longer uses %{app_name}'
diff --git a/config/routes.rb b/config/routes.rb
index cd0391f6206..78bbef3dcb0 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -190,6 +190,8 @@
       post '/test/device_profiling' => 'test/device_profiling#create'
     end
 
+    get '/security_check_failed' => 'security_check_failed#show'
+
     get '/auth_method_confirmation' => 'mfa_confirmation#show'
     post '/auth_method_confirmation/skip' => 'mfa_confirmation#skip'
 

From 66497daaede5608cbd2f469ddc2d2984ef8c67ec Mon Sep 17 00:00:00 2001
From: Malick Diarra <malick.diarra@gsa.gov>
Date: Mon, 8 Jul 2024 14:41:10 -0400
Subject: [PATCH 02/13] fix spec

---
 spec/controllers/users/sessions_controller_spec.rb | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/spec/controllers/users/sessions_controller_spec.rb b/spec/controllers/users/sessions_controller_spec.rb
index c22af06d3bd..50d5ff0e644 100644
--- a/spec/controllers/users/sessions_controller_spec.rb
+++ b/spec/controllers/users/sessions_controller_spec.rb
@@ -233,6 +233,19 @@
       )
     end
 
+    it 'redirects unsuccessful authentication for failed reCAPTCHA to failed page' do
+      user = create(:user, :fully_registered)
+
+      allow(FeatureManagement).to receive(:sign_in_recaptcha_enabled?).and_return(true)
+      allow(IdentityConfig.store).to receive(:recaptcha_mock_validator).and_return(true)
+      allow(IdentityConfig.store).to receive(:sign_in_recaptcha_score_threshold).and_return(0.2)
+      stub_analytics
+
+      post :create, params: { user: { email: user.email, password: user.password, score: 0.1 } }
+
+      expect(response).to redirect_to security_check_failed_url
+    end
+
     it 'tracks count of multiple unsuccessful authentication attempts' do
       user = create(
         :user,

From 89c95532dcf57b47f65fd148ce3213f7e24e0822 Mon Sep 17 00:00:00 2001
From: Malick Diarra <malick.diarra@gsa.gov>
Date: Tue, 9 Jul 2024 10:08:37 -0400
Subject: [PATCH 03/13] add test to ensure user redirected to security check
 failed

---
 spec/features/users/sign_in_spec.rb | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/spec/features/users/sign_in_spec.rb b/spec/features/users/sign_in_spec.rb
index 20fceb7bd6b..c5a72ee4f20 100644
--- a/spec/features/users/sign_in_spec.rb
+++ b/spec/features/users/sign_in_spec.rb
@@ -968,6 +968,23 @@
     end
   end
 
+  context 'Recaptcha check fails' do
+    let(:user) { create(:user, :fully_registered) }
+    before do
+      allow(FeatureManagement).to receive(:sign_in_recaptcha_enabled?).and_return(true)
+      allow(IdentityConfig.store).to receive(:recaptcha_mock_validator).and_return(true)
+      allow(IdentityConfig.store).to receive(:sign_in_recaptcha_score_threshold).and_return(0.2)
+    end
+
+    it 'redirects user to security check failed page' do
+      visit new_user_session_path
+      fill_in :user_recaptcha_mock_score, with: '0.1'
+      fill_in_credentials_and_submit(user.email, user.password)
+
+      expect(current_path).to eq security_check_failed_path
+    end
+  end
+
   context 'check_password_compromised feature toggle is true' do
     before do
       allow(FeatureManagement).to receive(:check_password_enabled?).and_return(true)

From 8d917b04eca42ef9c7cc00e4befa21f1f84a4fa1 Mon Sep 17 00:00:00 2001
From: Malick Diarra <malick.diarra@gsa.gov>
Date: Tue, 16 Jul 2024 11:38:36 -0400
Subject: [PATCH 04/13] add additional languges and page

---
 app/views/security_check_failed/show.html.erb | 12 ++++++------
 config/locales/en.yml                         |  6 +++---
 config/locales/es.yml                         |  8 ++++++++
 config/locales/fr.yml                         |  8 ++++++++
 config/locales/zh.yml                         |  8 ++++++++
 5 files changed, 33 insertions(+), 9 deletions(-)

diff --git a/app/views/security_check_failed/show.html.erb b/app/views/security_check_failed/show.html.erb
index 8ea96e856e0..053cfb73d9e 100644
--- a/app/views/security_check_failed/show.html.erb
+++ b/app/views/security_check_failed/show.html.erb
@@ -5,7 +5,7 @@
 <p>
   <%= t('security_check_failed.details_html') %>
   <%= new_tab_link_to(
-        t('security_check_failed.learn_more'),
+        t('security_check_failed.learn_more', app_name: APP_NAME),
         help_center_redirect_path(
           category: 'trouble-signing-in',
           article: 'security-check-failed',
@@ -14,12 +14,12 @@
 </p>
 
 <ul class="usa-list margin-top-0">
-  <li><%=  t('security_check_failed.info_p1') %></li>
+  <li><%= t('security_check_failed.info_p1', app_name: APP_NAME) %></li>
   <li><%= link_to(
-        t('security_check_failed.info_p2_link'),
-        login_piv_cac_url
-      ) + " "+ t('security_check_failed.info_p2_part2') %></li> 
-  <li><%=  t('security_check_failed.info_p3') %></li> 
+            t('security_check_failed.info_p2_link'),
+            login_piv_cac_url,
+          ) + ' ' + t('security_check_failed.info_p2_part2') %></li> 
+  <li><%= t('security_check_failed.info_p3') %></li> 
 </ul>
 
 <%= render 'two_factor_authentication/troubleshooting_options', presenter: @presenter %>
diff --git a/config/locales/en.yml b/config/locales/en.yml
index c4b30ae7084..8b5465ea481 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -1487,14 +1487,14 @@ risc.security_event.errors.typ_error: typ header must be %{expected_typ}
 saml_idp.auth.error.title: Error
 saml_idp.shared.saml_post_binding.heading: Submit to continue
 saml_idp.shared.saml_post_binding.no_js: JavaScript seems to be turned off in your browser. Normally this step happens automatically, but because you have JavaScript turned off, please click the submit button to continue signing in or signing out.
+security_check_failed.contact: Contact %{app_name} support
 security_check_failed.details_html: We don’t recognize the device or browser you’re signing in from.
-security_check_failed.info_p1: 'Use the same device and browser you created your Login.gov account with.'
+security_check_failed.info_p1: 'Use the same device and browser you created your %{app_name} account with.'
 security_check_failed.info_p2_link: Try signing in with your government employee ID
 security_check_failed.info_p2_part2: if you are a government employee.
 security_check_failed.info_p3: Turn off any VPN, ad blockers, and clear your cache.
-security_check_failed.learn_more: Learn more about Login.gov’s security checks
+security_check_failed.learn_more: Learn more about %{app_name}’s security checks
 security_check_failed.title: Security check failed
-security_check_failed.contact: Contact %{app_name} support
 service_providers.errors.generic_sp_name: This agency
 service_providers.errors.inactive.button_text: View my %{app_name} account
 service_providers.errors.inactive.heading: '%{sp_name} no longer uses %{app_name}'
diff --git a/config/locales/es.yml b/config/locales/es.yml
index 6d0dcb23d9b..209ee8712f0 100644
--- a/config/locales/es.yml
+++ b/config/locales/es.yml
@@ -1498,6 +1498,14 @@ risc.security_event.errors.typ_error: encabezado de tipo debe ser %{expected_typ
 saml_idp.auth.error.title: Error
 saml_idp.shared.saml_post_binding.heading: Enviar para continuar
 saml_idp.shared.saml_post_binding.no_js: JavaScript parece estar desactivado en su navegador. Por lo general, este paso es automático, pero, debido a que tiene JavaScript desactivado, haga clic en el botón Enviar para continuar iniciando sesión o cerrándola.
+security_check_failed.contact: Contacte con el servicio de asistencia de %{app_name}
+security_check_failed.details_html: No reconocemos el dispositivo o el navegador desde el que está iniciando sesión.
+security_check_failed.info_p1: 'Utilice el mismo dispositivo y navegador con el que creó su cuenta en %{app_name}.'
+security_check_failed.info_p2_link: Intente iniciar sesión con su identificación de empleado del gobierno
+security_check_failed.info_p2_part2: si es un empleado del gobierno.
+security_check_failed.info_p3: Desactive cualquier VPN, bloqueador de anuncios y borre su caché.
+security_check_failed.learn_more: Obtenga más información sobre las comprobaciones de seguridad de %{app_name}
+security_check_failed.title: Falló la comprobación de seguridad
 service_providers.errors.generic_sp_name: Esta agencia
 service_providers.errors.inactive.button_text: Ver mi cuenta de %{app_name}
 service_providers.errors.inactive.heading: '%{sp_name} ya no utiliza %{app_name}'
diff --git a/config/locales/fr.yml b/config/locales/fr.yml
index a5724f1c6b9..81ba2e3b336 100644
--- a/config/locales/fr.yml
+++ b/config/locales/fr.yml
@@ -1487,6 +1487,14 @@ risc.security_event.errors.typ_error: l’en-tête typ doit être %{expected_typ
 saml_idp.auth.error.title: Erreur
 saml_idp.shared.saml_post_binding.heading: Valider pour continuer
 saml_idp.shared.saml_post_binding.no_js: JavaScript semble être désactivé dans votre navigateur. Normalement, cette étape se produit automatiquement, mais comme vous avez désactivé JavaScript, veuillez cliquer sur le bouton « Valider » pour poursuivre la connexion ou la déconnexion.
+security_check_failed.contact: Contactez l’assistance %{app_name}
+security_check_failed.details_html: Nous ne reconnaissons pas l’appareil ou le navigateur à partir duquel vous vous connectez.
+security_check_failed.info_p1: 'Utilisez le même appareil et le même navigateur que ceux avec lesquels vous aviez créé votre compte %{app_name}.'
+security_check_failed.info_p2_link: Essayez de vous connecter avec votre carte d’employé fédéral
+security_check_failed.info_p2_part2: si vous êtes employé fédéral.
+security_check_failed.info_p3: Désactivez tout éventuel VPN ou bloqueur de publicité et videz votre cache.
+security_check_failed.learn_more: En savoir plus sur les tests de sécurité de %{app_name}
+security_check_failed.title: Échec du test de sécurité
 service_providers.errors.generic_sp_name: Cet organisme
 service_providers.errors.inactive.button_text: Voir mon compte %{app_name}
 service_providers.errors.inactive.heading: '%{sp_name} n’utilise plus %{app_name}'
diff --git a/config/locales/zh.yml b/config/locales/zh.yml
index f199579ceba..75dc9f56b6c 100644
--- a/config/locales/zh.yml
+++ b/config/locales/zh.yml
@@ -1503,6 +1503,14 @@ risc.security_event.errors.typ_error: 类型标头必须是 %{expected_typ}
 saml_idp.auth.error.title: 错误
 saml_idp.shared.saml_post_binding.heading: 提交来继续
 saml_idp.shared.saml_post_binding.no_js: 你浏览器中的 JavaScript 似乎已关闭。该步骤通常会自动发生，但因为你把 JavaScript 关闭，请点击提交按钮来继续登入或登出。
+security_check_failed.contact: 请联系 %{app_name}支持
+security_check_failed.details_html: 我们不认识您登录正在使用的设备或浏览器。
+security_check_failed.info_p1: '使用您设立自己 %{app_name} 账户时的同一设备和浏览器。'
+security_check_failed.info_p2_link: 尝试用您的政府雇员身份证件登录。
+security_check_failed.info_p2_part2: 如果您是政府雇员.
+security_check_failed.info_p3: 关闭任何 VPN 和广告拦截器并清除缓存。
+security_check_failed.learn_more: 了解 %{app_name} 安全检查的更多信息
+security_check_failed.title: 安全检查未通过
 service_providers.errors.generic_sp_name: 该机构
 service_providers.errors.inactive.button_text: 查看我的 %{app_name} 账户
 service_providers.errors.inactive.heading: '%{sp_name} 不再使用 %{app_name}'

From 4ef864c9895166a74104db5469b35f582dfde300 Mon Sep 17 00:00:00 2001
From: Malick Diarra <malick.diarra@gsa.gov>
Date: Wed, 17 Jul 2024 10:35:03 -0400
Subject: [PATCH 05/13] address comments

---
 .../security_check_failed_controller.rb       |  8 -----
 ...ign_in_security_check_failed_controller.rb |  7 +++++
 app/controllers/users/sessions_controller.rb  |  2 +-
 .../security_check_failed_presenter.rb        | 12 -------
 app/services/analytics_events.rb              |  1 +
 app/views/security_check_failed/show.html.erb | 27 ----------------
 .../show.html.erb                             | 31 +++++++++++++++++++
 config/locales/en.yml                         |  5 ++-
 config/locales/es.yml                         |  5 ++-
 config/locales/fr.yml                         |  5 ++-
 config/locales/zh.yml                         |  5 ++-
 config/routes.rb                              |  2 +-
 .../users/sessions_controller_spec.rb         |  3 +-
 spec/features/users/sign_in_spec.rb           |  2 +-
 14 files changed, 51 insertions(+), 64 deletions(-)
 delete mode 100644 app/controllers/security_check_failed_controller.rb
 create mode 100644 app/controllers/sign_in_security_check_failed_controller.rb
 delete mode 100644 app/presenters/security_check_failed_presenter.rb
 delete mode 100644 app/views/security_check_failed/show.html.erb
 create mode 100644 app/views/sign_in_security_check_failed/show.html.erb

diff --git a/app/controllers/security_check_failed_controller.rb b/app/controllers/security_check_failed_controller.rb
deleted file mode 100644
index 078484c1891..00000000000
--- a/app/controllers/security_check_failed_controller.rb
+++ /dev/null
@@ -1,8 +0,0 @@
-# frozen_string_literal: true
-
-class SecurityCheckFailedController < ApplicationController
-  def show
-    @presenter = SecurityCheckFailedPresenter.new
-    analytics.security_check_failed_visited
-  end
-end
diff --git a/app/controllers/sign_in_security_check_failed_controller.rb b/app/controllers/sign_in_security_check_failed_controller.rb
new file mode 100644
index 00000000000..900de285721
--- /dev/null
+++ b/app/controllers/sign_in_security_check_failed_controller.rb
@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+class SignInSecurityCheckFailedController < ApplicationController
+  def show
+    analytics.security_check_failed_visited
+  end
+end
diff --git a/app/controllers/users/sessions_controller.rb b/app/controllers/users/sessions_controller.rb
index 021cb12ca6e..596e579702c 100644
--- a/app/controllers/users/sessions_controller.rb
+++ b/app/controllers/users/sessions_controller.rb
@@ -101,7 +101,7 @@ def valid_captcha_result?
     def process_failed_captcha
       warden.logout(:user)
       warden.lock!
-      redirect_to security_check_failed_url
+      redirect_to sign_in_security_check_failed_url
     end
 
     def recaptcha_form_args
diff --git a/app/presenters/security_check_failed_presenter.rb b/app/presenters/security_check_failed_presenter.rb
deleted file mode 100644
index ef73aa2385f..00000000000
--- a/app/presenters/security_check_failed_presenter.rb
+++ /dev/null
@@ -1,12 +0,0 @@
-# frozen_string_literal: true
-
-class SecurityCheckFailedPresenter
-  def troubleshooting_options
-    [
-      BlockLinkComponent.new(
-        url: MarketingSite.contact_url,
-        new_tab: true,
-      ).with_content(I18n.t('security_check_failed.contact', app_name: APP_NAME)),
-    ]
-  end
-end
diff --git a/app/services/analytics_events.rb b/app/services/analytics_events.rb
index 7f0f9be48c9..cab82cbae4f 100644
--- a/app/services/analytics_events.rb
+++ b/app/services/analytics_events.rb
@@ -5415,6 +5415,7 @@ def second_mfa_reminder_visit
     track_event('Second MFA Reminder Visited')
   end
 
+  # User lands on security check failed page
   def security_check_failed_visited
     track_event(:security_check_failed_visited)
   end
diff --git a/app/views/security_check_failed/show.html.erb b/app/views/security_check_failed/show.html.erb
deleted file mode 100644
index 053cfb73d9e..00000000000
--- a/app/views/security_check_failed/show.html.erb
+++ /dev/null
@@ -1,27 +0,0 @@
-<% self.title = t('security_check_failed.title') %>
-
-<%= render AlertIconComponent.new(icon_name: :warning, class: 'display-block margin-bottom-4') %>
-<%= render PageHeadingComponent.new.with_content(t('security_check_failed.title')) %>
-<p>
-  <%= t('security_check_failed.details_html') %>
-  <%= new_tab_link_to(
-        t('security_check_failed.learn_more', app_name: APP_NAME),
-        help_center_redirect_path(
-          category: 'trouble-signing-in',
-          article: 'security-check-failed',
-        ),
-      ) %>
-</p>
-
-<ul class="usa-list margin-top-0">
-  <li><%= t('security_check_failed.info_p1', app_name: APP_NAME) %></li>
-  <li><%= link_to(
-            t('security_check_failed.info_p2_link'),
-            login_piv_cac_url,
-          ) + ' ' + t('security_check_failed.info_p2_part2') %></li> 
-  <li><%= t('security_check_failed.info_p3') %></li> 
-</ul>
-
-<%= render 'two_factor_authentication/troubleshooting_options', presenter: @presenter %>
-
-<%= render 'shared/cancel', link: root_url %>
\ No newline at end of file
diff --git a/app/views/sign_in_security_check_failed/show.html.erb b/app/views/sign_in_security_check_failed/show.html.erb
new file mode 100644
index 00000000000..08fd8a8941d
--- /dev/null
+++ b/app/views/sign_in_security_check_failed/show.html.erb
@@ -0,0 +1,31 @@
+<% self.title = t('security_check_failed.title') %>
+
+<%= render StatusPageComponent.new(status: :warning) do |c| %>
+  <% c.with_header { t('security_check_failed.title') } %>
+  <p>
+    <%= t('security_check_failed.details') %>
+    <%= new_tab_link_to(
+          t('security_check_failed.learn_more', app_name: APP_NAME),
+          help_center_redirect_path(
+            category: 'trouble-signing-in',
+            article: 'security-check-failed',
+          ),
+        ) %>
+  </p>
+
+  <ul class="usa-list margin-top-0">
+    <li><%= t('security_check_failed.info_p1', app_name: APP_NAME) %></li>
+    <li><%= t('security_check_failed.info_p2_html', piv_cac_url: login_piv_cac_url) %></li> 
+    <li><%= t('security_check_failed.info_p3') %></li> 
+  </ul>
+
+  <%= render TroubleshootingOptionsComponent.new do |c| %>
+    <% c.with_header { t('components.troubleshooting_options.default_heading') } %>
+    <% c.with_option(
+        url: contact_redirect_url,
+        new_tab: true,
+      ).with_content(t('security_check_failed.contact', app_name: APP_NAME)) %>
+  <% end %>
+<% end %>
+
+<%= render 'shared/cancel', link: root_url %>
\ No newline at end of file
diff --git a/config/locales/en.yml b/config/locales/en.yml
index 8b5465ea481..5b1245f9fdb 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -1488,10 +1488,9 @@ saml_idp.auth.error.title: Error
 saml_idp.shared.saml_post_binding.heading: Submit to continue
 saml_idp.shared.saml_post_binding.no_js: JavaScript seems to be turned off in your browser. Normally this step happens automatically, but because you have JavaScript turned off, please click the submit button to continue signing in or signing out.
 security_check_failed.contact: Contact %{app_name} support
-security_check_failed.details_html: We don’t recognize the device or browser you’re signing in from.
+security_check_failed.details: We don’t recognize the device or browser you’re signing in from.
 security_check_failed.info_p1: 'Use the same device and browser you created your %{app_name} account with.'
-security_check_failed.info_p2_link: Try signing in with your government employee ID
-security_check_failed.info_p2_part2: if you are a government employee.
+security_check_failed.info_p2_html: Try <a href="%{piv_cac_url}">signing in with your government employee ID</a> if you are a government employee.
 security_check_failed.info_p3: Turn off any VPN, ad blockers, and clear your cache.
 security_check_failed.learn_more: Learn more about %{app_name}’s security checks
 security_check_failed.title: Security check failed
diff --git a/config/locales/es.yml b/config/locales/es.yml
index 209ee8712f0..608901d817d 100644
--- a/config/locales/es.yml
+++ b/config/locales/es.yml
@@ -1499,10 +1499,9 @@ saml_idp.auth.error.title: Error
 saml_idp.shared.saml_post_binding.heading: Enviar para continuar
 saml_idp.shared.saml_post_binding.no_js: JavaScript parece estar desactivado en su navegador. Por lo general, este paso es automático, pero, debido a que tiene JavaScript desactivado, haga clic en el botón Enviar para continuar iniciando sesión o cerrándola.
 security_check_failed.contact: Contacte con el servicio de asistencia de %{app_name}
-security_check_failed.details_html: No reconocemos el dispositivo o el navegador desde el que está iniciando sesión.
+security_check_failed.details: No reconocemos el dispositivo o el navegador desde el que está iniciando sesión.
 security_check_failed.info_p1: 'Utilice el mismo dispositivo y navegador con el que creó su cuenta en %{app_name}.'
-security_check_failed.info_p2_link: Intente iniciar sesión con su identificación de empleado del gobierno
-security_check_failed.info_p2_part2: si es un empleado del gobierno.
+security_check_failed.info_p2_html: Intente <a href="%{piv_cac_url}">iniciar sesión con su identificación de empleado del gobierno</a> si es un empleado del gobierno.
 security_check_failed.info_p3: Desactive cualquier VPN, bloqueador de anuncios y borre su caché.
 security_check_failed.learn_more: Obtenga más información sobre las comprobaciones de seguridad de %{app_name}
 security_check_failed.title: Falló la comprobación de seguridad
diff --git a/config/locales/fr.yml b/config/locales/fr.yml
index 81ba2e3b336..1df6258bf85 100644
--- a/config/locales/fr.yml
+++ b/config/locales/fr.yml
@@ -1488,10 +1488,9 @@ saml_idp.auth.error.title: Erreur
 saml_idp.shared.saml_post_binding.heading: Valider pour continuer
 saml_idp.shared.saml_post_binding.no_js: JavaScript semble être désactivé dans votre navigateur. Normalement, cette étape se produit automatiquement, mais comme vous avez désactivé JavaScript, veuillez cliquer sur le bouton « Valider » pour poursuivre la connexion ou la déconnexion.
 security_check_failed.contact: Contactez l’assistance %{app_name}
-security_check_failed.details_html: Nous ne reconnaissons pas l’appareil ou le navigateur à partir duquel vous vous connectez.
+security_check_failed.details: Nous ne reconnaissons pas l’appareil ou le navigateur à partir duquel vous vous connectez.
 security_check_failed.info_p1: 'Utilisez le même appareil et le même navigateur que ceux avec lesquels vous aviez créé votre compte %{app_name}.'
-security_check_failed.info_p2_link: Essayez de vous connecter avec votre carte d’employé fédéral
-security_check_failed.info_p2_part2: si vous êtes employé fédéral.
+security_check_failed.info_p2_html: Essayez <a href="%{piv_cac_url}">de vous connecter avec votre carte d’employé fédéral</a> si vous êtes employé fédéral.
 security_check_failed.info_p3: Désactivez tout éventuel VPN ou bloqueur de publicité et videz votre cache.
 security_check_failed.learn_more: En savoir plus sur les tests de sécurité de %{app_name}
 security_check_failed.title: Échec du test de sécurité
diff --git a/config/locales/zh.yml b/config/locales/zh.yml
index 75dc9f56b6c..1231fb1b8d0 100644
--- a/config/locales/zh.yml
+++ b/config/locales/zh.yml
@@ -1504,10 +1504,9 @@ saml_idp.auth.error.title: 错误
 saml_idp.shared.saml_post_binding.heading: 提交来继续
 saml_idp.shared.saml_post_binding.no_js: 你浏览器中的 JavaScript 似乎已关闭。该步骤通常会自动发生，但因为你把 JavaScript 关闭，请点击提交按钮来继续登入或登出。
 security_check_failed.contact: 请联系 %{app_name}支持
-security_check_failed.details_html: 我们不认识您登录正在使用的设备或浏览器。
+security_check_failed.details: 我们不认识您登录正在使用的设备或浏览器。
 security_check_failed.info_p1: '使用您设立自己 %{app_name} 账户时的同一设备和浏览器。'
-security_check_failed.info_p2_link: 尝试用您的政府雇员身份证件登录。
-security_check_failed.info_p2_part2: 如果您是政府雇员.
+security_check_failed.info_p2_html: '如果您是政府雇员，尝试<a href="%{piv_cac_url}">用您的政府雇员身份证件登录。</a>'
 security_check_failed.info_p3: 关闭任何 VPN 和广告拦截器并清除缓存。
 security_check_failed.learn_more: 了解 %{app_name} 安全检查的更多信息
 security_check_failed.title: 安全检查未通过
diff --git a/config/routes.rb b/config/routes.rb
index 78bbef3dcb0..8a8d569d78c 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -190,7 +190,7 @@
       post '/test/device_profiling' => 'test/device_profiling#create'
     end
 
-    get '/security_check_failed' => 'security_check_failed#show'
+    get '/sign_in_security_check_failed' => 'sign_in_security_check_failed#show'
 
     get '/auth_method_confirmation' => 'mfa_confirmation#show'
     post '/auth_method_confirmation/skip' => 'mfa_confirmation#skip'
diff --git a/spec/controllers/users/sessions_controller_spec.rb b/spec/controllers/users/sessions_controller_spec.rb
index 50d5ff0e644..9a0cf3ec987 100644
--- a/spec/controllers/users/sessions_controller_spec.rb
+++ b/spec/controllers/users/sessions_controller_spec.rb
@@ -239,11 +239,10 @@
       allow(FeatureManagement).to receive(:sign_in_recaptcha_enabled?).and_return(true)
       allow(IdentityConfig.store).to receive(:recaptcha_mock_validator).and_return(true)
       allow(IdentityConfig.store).to receive(:sign_in_recaptcha_score_threshold).and_return(0.2)
-      stub_analytics
 
       post :create, params: { user: { email: user.email, password: user.password, score: 0.1 } }
 
-      expect(response).to redirect_to security_check_failed_url
+      expect(response).to redirect_to sign_in_security_check_failed_url
     end
 
     it 'tracks count of multiple unsuccessful authentication attempts' do
diff --git a/spec/features/users/sign_in_spec.rb b/spec/features/users/sign_in_spec.rb
index c5a72ee4f20..bc735150a9d 100644
--- a/spec/features/users/sign_in_spec.rb
+++ b/spec/features/users/sign_in_spec.rb
@@ -981,7 +981,7 @@
       fill_in :user_recaptcha_mock_score, with: '0.1'
       fill_in_credentials_and_submit(user.email, user.password)
 
-      expect(current_path).to eq security_check_failed_path
+      expect(current_path).to eq sign_in_security_check_failed_path
     end
   end
 

From 7c41324dec39b89766ea57c12f5537abf619cad7 Mon Sep 17 00:00:00 2001
From: Malick Diarra <malick.diarra@gsa.gov>
Date: Wed, 17 Jul 2024 12:19:28 -0400
Subject: [PATCH 06/13] lint fix

---
 app/views/sign_in_security_check_failed/show.html.erb | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/app/views/sign_in_security_check_failed/show.html.erb b/app/views/sign_in_security_check_failed/show.html.erb
index 08fd8a8941d..7569e722fc4 100644
--- a/app/views/sign_in_security_check_failed/show.html.erb
+++ b/app/views/sign_in_security_check_failed/show.html.erb
@@ -22,9 +22,9 @@
   <%= render TroubleshootingOptionsComponent.new do |c| %>
     <% c.with_header { t('components.troubleshooting_options.default_heading') } %>
     <% c.with_option(
-        url: contact_redirect_url,
-        new_tab: true,
-      ).with_content(t('security_check_failed.contact', app_name: APP_NAME)) %>
+         url: contact_redirect_url,
+         new_tab: true,
+       ).with_content(t('security_check_failed.contact', app_name: APP_NAME)) %>
   <% end %>
 <% end %>
 

From 0213dac37634bc8f8dea6837a06e2e7eb090b07d Mon Sep 17 00:00:00 2001
From: Malick Diarra <malick.diarra@gsa.gov>
Date: Thu, 18 Jul 2024 09:30:26 -0400
Subject: [PATCH 07/13] address comments

---
 .../sign_in_security_check_failed_controller.rb        |  2 +-
 app/services/analytics_events.rb                       | 10 +++++-----
 app/services/marketing_site.rb                         |  1 +
 app/views/sign_in_security_check_failed/show.html.erb  |  8 ++++----
 4 files changed, 11 insertions(+), 10 deletions(-)

diff --git a/app/controllers/sign_in_security_check_failed_controller.rb b/app/controllers/sign_in_security_check_failed_controller.rb
index 900de285721..e249d6a0059 100644
--- a/app/controllers/sign_in_security_check_failed_controller.rb
+++ b/app/controllers/sign_in_security_check_failed_controller.rb
@@ -2,6 +2,6 @@
 
 class SignInSecurityCheckFailedController < ApplicationController
   def show
-    analytics.security_check_failed_visited
+    analytics.sign_in_security_check_failed_visited
   end
 end
diff --git a/app/services/analytics_events.rb b/app/services/analytics_events.rb
index cab82cbae4f..b8f5c44d14f 100644
--- a/app/services/analytics_events.rb
+++ b/app/services/analytics_events.rb
@@ -5415,11 +5415,6 @@ def second_mfa_reminder_visit
     track_event('Second MFA Reminder Visited')
   end
 
-  # User lands on security check failed page
-  def security_check_failed_visited
-    track_event(:security_check_failed_visited)
-  end
-
   # Tracks when security event is received
   # @param [Boolean] success Whether form validation was successful
   # @param [String] error_code
@@ -5477,6 +5472,11 @@ def sign_in_page_visit(flash:, **extra)
     track_event('Sign in page visited', flash:, **extra)
   end
 
+  # User lands on security check failed page
+  def sign_in_security_check_failed_visited
+    track_event(:sign_in_security_check_failed_visited)
+  end
+
   # @param [Boolean] success
   # @param [Boolean] new_user
   # @param [Boolean] has_other_auth_methods
diff --git a/app/services/marketing_site.rb b/app/services/marketing_site.rb
index 08ad301235c..4a3d7711cb8 100644
--- a/app/services/marketing_site.rb
+++ b/app/services/marketing_site.rb
@@ -10,6 +10,7 @@ class UnknownArticleException < StandardError; end
     manage-your-account/add-or-change-your-authentication-method
     manage-your-account/personal-key
     trouble-signing-in/face-or-touch-unlock
+    trouble-signing-in/security-check-failed
     verify-your-identity/accepted-identification-documents
     verify-your-identity/accepted-state-issued-identification
     verify-your-identity/how-to-add-images-of-your-state-issued-id
diff --git a/app/views/sign_in_security_check_failed/show.html.erb b/app/views/sign_in_security_check_failed/show.html.erb
index 7569e722fc4..510591d2bb2 100644
--- a/app/views/sign_in_security_check_failed/show.html.erb
+++ b/app/views/sign_in_security_check_failed/show.html.erb
@@ -13,15 +13,15 @@
         ) %>
   </p>
 
-  <ul class="usa-list margin-top-0">
+  <ul class="usa-list">
     <li><%= t('security_check_failed.info_p1', app_name: APP_NAME) %></li>
     <li><%= t('security_check_failed.info_p2_html', piv_cac_url: login_piv_cac_url) %></li> 
     <li><%= t('security_check_failed.info_p3') %></li> 
   </ul>
 
-  <%= render TroubleshootingOptionsComponent.new do |c| %>
-    <% c.with_header { t('components.troubleshooting_options.default_heading') } %>
-    <% c.with_option(
+  <%= tc.with_troubleshooting_options.new do |tc| %>
+    <% tc.with_header { t('components.troubleshooting_options.default_heading') } %>
+    <% tc.with_option(
          url: contact_redirect_url,
          new_tab: true,
        ).with_content(t('security_check_failed.contact', app_name: APP_NAME)) %>

From 4ff0a31860397f7daebb04d5953c04692f91b9a2 Mon Sep 17 00:00:00 2001
From: Malick Diarra <malick.diarra@gsa.gov>
Date: Thu, 18 Jul 2024 09:58:00 -0400
Subject: [PATCH 08/13] use c

---
 app/views/sign_in_security_check_failed/show.html.erb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/views/sign_in_security_check_failed/show.html.erb b/app/views/sign_in_security_check_failed/show.html.erb
index 510591d2bb2..6e8797e2d9c 100644
--- a/app/views/sign_in_security_check_failed/show.html.erb
+++ b/app/views/sign_in_security_check_failed/show.html.erb
@@ -19,7 +19,7 @@
     <li><%= t('security_check_failed.info_p3') %></li> 
   </ul>
 
-  <%= tc.with_troubleshooting_options.new do |tc| %>
+  <%= c.with_troubleshooting_options.new do |tc| %>
     <% tc.with_header { t('components.troubleshooting_options.default_heading') } %>
     <% tc.with_option(
          url: contact_redirect_url,

From 9d3e18f556e66fd948308135919729c35f4cddaa Mon Sep 17 00:00:00 2001
From: Malick Diarra <malick.diarra@gsa.gov>
Date: Fri, 19 Jul 2024 10:19:13 -0400
Subject: [PATCH 09/13] fix failed

---
 app/views/sign_in_security_check_failed/show.html.erb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/views/sign_in_security_check_failed/show.html.erb b/app/views/sign_in_security_check_failed/show.html.erb
index 6e8797e2d9c..63cd9469a94 100644
--- a/app/views/sign_in_security_check_failed/show.html.erb
+++ b/app/views/sign_in_security_check_failed/show.html.erb
@@ -19,7 +19,7 @@
     <li><%= t('security_check_failed.info_p3') %></li> 
   </ul>
 
-  <%= c.with_troubleshooting_options.new do |tc| %>
+  <% c.with_troubleshooting_options do |tc| %>
     <% tc.with_header { t('components.troubleshooting_options.default_heading') } %>
     <% tc.with_option(
          url: contact_redirect_url,

From 12d6b3cfa4eb31df68a6141a930ff55fa075a103 Mon Sep 17 00:00:00 2001
From: Malick Diarra <malick.diarra@gsa.gov>
Date: Fri, 19 Jul 2024 10:49:34 -0400
Subject: [PATCH 10/13] sign in security check controller spec added

---
 ...n_security_check_failed_controller_spec.rb | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)
 create mode 100644 spec/controllers/sign_in_security_check_failed_controller_spec.rb

diff --git a/spec/controllers/sign_in_security_check_failed_controller_spec.rb b/spec/controllers/sign_in_security_check_failed_controller_spec.rb
new file mode 100644
index 00000000000..f5b1391e245
--- /dev/null
+++ b/spec/controllers/sign_in_security_check_failed_controller_spec.rb
@@ -0,0 +1,19 @@
+require 'rails_helper'
+
+RSpec.describe SignInSecurityCheckFailedController do
+  let(:user) { build_stubbed(:user, :fully_registered) }
+
+  before do
+    stub_sign_in(user)
+  end
+
+  it 'renders the show template' do
+    stub_analytics
+
+    get :show
+
+    expect(@analytics).to have_logged_event(:sign_in_security_check_failed_visited)
+
+    expect(response).to render_template :show
+  end
+end

From c62afd464153f7180e7bf295d752c7eeb48e2935 Mon Sep 17 00:00:00 2001
From: Malick Diarra <malick.diarra@gsa.gov>
Date: Mon, 22 Jul 2024 10:01:56 -0400
Subject: [PATCH 11/13] change spec name

---
 ...ign_in_security_check_failed_controller_spec.rb | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/spec/controllers/sign_in_security_check_failed_controller_spec.rb b/spec/controllers/sign_in_security_check_failed_controller_spec.rb
index f5b1391e245..533405fb034 100644
--- a/spec/controllers/sign_in_security_check_failed_controller_spec.rb
+++ b/spec/controllers/sign_in_security_check_failed_controller_spec.rb
@@ -7,13 +7,11 @@
     stub_sign_in(user)
   end
 
-  it 'renders the show template' do
-    stub_analytics
-
-    get :show
-
-    expect(@analytics).to have_logged_event(:sign_in_security_check_failed_visited)
-
-    expect(response).to render_template :show
+  describe '#show' do
+    it 'logs an event' do
+      stub_analytics
+      get :show
+      expect(@analytics).to have_logged_event(:sign_in_security_check_failed_visited)
+    end
   end
 end

From 597546dcbbeab70e78966c79364d1b0ae4fed914 Mon Sep 17 00:00:00 2001
From: Malick Diarra <malick.diarra@gsa.gov>
Date: Mon, 22 Jul 2024 11:54:36 -0400
Subject: [PATCH 12/13] use back instead of cancel

---
 app/views/sign_in_security_check_failed/show.html.erb | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/app/views/sign_in_security_check_failed/show.html.erb b/app/views/sign_in_security_check_failed/show.html.erb
index 63cd9469a94..cefc52ee39d 100644
--- a/app/views/sign_in_security_check_failed/show.html.erb
+++ b/app/views/sign_in_security_check_failed/show.html.erb
@@ -28,4 +28,6 @@
   <% end %>
 <% end %>
 
-<%= render 'shared/cancel', link: root_url %>
\ No newline at end of file
+<%= render PageFooterComponent.new do %>
+  <%= link_to t('forms.buttons.back'), root_url %>
+<% end %>
\ No newline at end of file

From 3cae2db006a47d814d4896f980eaa5f635ec2732 Mon Sep 17 00:00:00 2001
From: Malick Diarra <malick.diarra@gsa.gov>
Date: Mon, 22 Jul 2024 12:38:28 -0400
Subject: [PATCH 13/13] update security check failed spec

---
 .../sign_in_security_check_failed_controller_spec.rb        | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/spec/controllers/sign_in_security_check_failed_controller_spec.rb b/spec/controllers/sign_in_security_check_failed_controller_spec.rb
index 533405fb034..661a1012a6f 100644
--- a/spec/controllers/sign_in_security_check_failed_controller_spec.rb
+++ b/spec/controllers/sign_in_security_check_failed_controller_spec.rb
@@ -1,12 +1,6 @@
 require 'rails_helper'
 
 RSpec.describe SignInSecurityCheckFailedController do
-  let(:user) { build_stubbed(:user, :fully_registered) }
-
-  before do
-    stub_sign_in(user)
-  end
-
   describe '#show' do
     it 'logs an event' do
       stub_analytics