GoLocomotiveSign in and accounts
How people sign in to your app, how a second step protects sensitive roles, and what a user can change on their own account.
Every app has its own accounts. A person who uses two apps has two accounts, one in each. You create them in the portal (Users and access), and the app handles the rest.
Sign in#
- Email and password. The default. The app can also accept a second identifier, such as a user name.
- A code by email. The app mails a short code, valid a few minutes, and the person types it. An app can offer it on its own or as a second step.
- A second step for sensitive roles. The app can ask for a code after the password, for some roles only: an admin, for example. A person who typed the right password sees the code step, never a "wrong password" message.
A session lasts 12 hours by default. After it, the person signs in again.
Protection on the sign in page#
- Repeated attempts from one address are slowed down: 5 tries in 3 seconds, then a pause.
- Codes accept 5 tries per account in 3 minutes.
- A request for a password reset or a code answers the same way for an unknown email, so nobody can test which emails have an account.
- New device alerts. When an account signs in from a new device or place, the app mails its owner, unless your app turns this off.
What a user changes on their own account#
From the profile menu, each user can:
- change their name;
- change their password (they type the old one first, so a stolen open session cannot set a new password);
- change their email address: the app mails a link to the new address, and the change happens only when the person opens it and types their password;
- pick their language;
- sign out.
A password reset or an email change ends every open session of that account.
Switch an account off#
An account switched off in the portal cannot sign in, and its open sessions end at once. Its data and its history stay.
Emails the app sends#
Sign in emails (the code, the reset link, the email change link, the new device alert) exist in English and French. Your app can change their text, and adds its own footer to every mail. See Files and email.
Not available yet#
Sign in with Google, Microsoft or another outside account, and a check of the email address at sign up, are not part of the toolkit today. See Not available yet.