Skip to content

LG-15183: Associate user_id for reCAPTCHA result analytics of failed sign-in#11580

Merged
aduth merged 4 commits intomainfrom
aduth-lg-15183-recaptcha-user-id
Dec 3, 2024
Merged

LG-15183: Associate user_id for reCAPTCHA result analytics of failed sign-in#11580
aduth merged 4 commits intomainfrom
aduth-lg-15183-recaptcha-user-id

Conversation

@aduth
Copy link
Contributor

@aduth aduth commented Dec 3, 2024

🎫 Ticket

LG-15183

🛠 Summary of changes

Fixes an issue where the "reCAPTCHA verify result received" event does not correctly associate the user_id if the sign-in attempt is unsuccessful for a reason other than reCAPTCHA.

This happens because the user is not yet signed-in. For "Email and Password Authentication" events, we work around this by explicitly passing the user_id from the user associated with the given email parameter. The changes proposed here instead override the base ApplicationController#analytics_user to use this parameter-based user during the submission, so that all analytics logging will have that user associated.

📜 Testing Plan

Verify that both "Email and Password Authentication" and "reCAPTCHA verify result received" events include the user_id property of the user associated with the submitted email address:

  1. Run make watch_events in a separate terminal process
  2. Go to http://localhost:3000
  3. Enter an email address associated with a user account (or not associated with an account, to verify expected nil user_id)
  4. Enter a correct or incorrect password for that user account
  5. Click "Sign in"
  6. In the make watch_events process, observe events "Email and Password Authentication" and "reCAPTCHA verify result received" both have associated user_id, regardless if you entered a correct password for the account

…sign-in

changelog: Internal, Anti-Fraud, Associate user_id for reCAPTCHA result analytics of failed sign-in
@aduth aduth requested a review from a team December 3, 2024 14:01
Comment on lines -327 to +329
original_analytics = original.call
if original_analytics.request.params[:controller] == 'users/sessions' &&
original_analytics.request.params[:action] == 'create'
expect(original_analytics.user).to eq(user)
if original.receiver.instance_of?(Users::SessionsController) &&
original.receiver.action_name == 'create'
expect(original.call.user).to eq(user)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These changes are necessary because the unsuccessful submission will result in a redirect back to the sign-in page, which counterintuitively keeps original_analytics.request.params[:action] == 'create' even in the processing of the #new action, since the action is processed as a result of the submission's redirect. Since user_id is expected to be nil on the "Sign in page visited" event, the previous implementation would raise an exception. These changes are to limit assertions to only analytics logged during #create.

@aduth aduth merged commit 165ef18 into main Dec 3, 2024
@aduth aduth deleted the aduth-lg-15183-recaptcha-user-id branch December 3, 2024 19:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants