Sign In with verification code

Overview

• We need to implement a friendly way for users to access the desktop platform.

User Stories

As a user, I want to request a verification code using my email so that I can securely access the system by receiving a code or a link and enter into the system.

Functional Requirements:

1. Email Input
   • The system should provide a field where users can input their email address.
2. Verification Code Generation
   • Upon user request, the system should generate a unique verification code.
3. Email Sending Capability
   • The system should send the generated verification code to the user's email address.
4. Code Validation Mechanism
   • Users should be able to input the received verification code into the system.
   • The system should validate the correctness of the inputted code against the generated one.
5. Access Granting
   • Upon successful verification, the system should grant the user access.

Risks and Mitigation:

1. Risk: Users not receiving the verification code email.
   • Mitigation: Implement a "Resend Code" option. Ensure that email sending services are reliable, and consider implementing measures to avoid emails going to the spam/junk folder.
2. Risk: System's email sending capability goes down or becomes unreliable.
   • Mitigation: Use a well-established third-party email service with high reliability and uptime. Have backup services or providers in place. Monitor and alert on email delivery failures.
3. Risk: Users inputting their email incorrectly, resulting in someone else potentially receiving the verification code.
   • Mitigation: Allow users to review and confirm their email before sending the code. Implement a two-step process where the user first confirms their email address before a code is sent.
4. Risk: Stored verification codes can be a vulnerability if there's a data breach.
   • Mitigation: Do not store verification codes in plain text. Consider not storing them at all if feasible or delete them once used or expired.