Skip to content
세종대학교 교표PRO-SEJONGPEIA

Login verdict and account lock protection

Why it is hard

Section titled “Why it is hard”

The portal answers a failed login with HTTP 200 too, so the status code cannot tell success from failure. The result is inside a script of the small HTML page that comes back.

var result = '<value>'

On top of that, every wrong password raises the portal’s failure count, and past a certain count the account is locked. Retrying failed logins out of habit locks the user’s account.

The verdict flow at a glance

Section titled “The verdict flow at a glance”

Verdicts and error codes

Section titled “Verdicts and error codes”
result value Meaning of the portal message Library
OK Success (redirects to the return address) Continue
erridpwd, Error ID or password does not match AUTHENTICATION_FAILED, stop with no further requests
pwdNeedChg Account locked after repeated wrong passwords ACCOUNT_LOCKED
invalidDt, invalid Use period ended, or blocked by the administrator ACCOUNT_UNAVAILABLE
Any other value Error while processing the login SESSION_ERROR
No var result Treated as a changed portal page format Continue; a 401 in a later step decides

spec/contract.json is the single source of this mapping, and the tests of all three languages check they use the same values.

The library’s rules

Section titled “The library’s rules”
  • A login the portal rejected (wrong password, lock, unavailable) is never retried. It stops at the first failure.
  • Retries are for transport problems only, such as non-2xx answers or timeouts (Configuration).
  • The integrated call logs in once, so the failure count rises at most once per call.
  • Blank input ends with INVALID_INPUT without sending any request.

What was not verified about the lock count

Section titled “What was not verified about the lock count”

Comments in the portal source say the lock happens after 5 failures, and the portal’s own notice says about 5. But the exact count, and whether a successful login resets it, are not verified. Treat it conservatively.

If you implement it yourself

Section titled “If you implement it yourself”
  • Read the verdict in the response body, not the status code. Samples are spec/fixtures/portal_login_ok.html and portal_login_erridpwd.html in the repository.
  • Treat an unknown verdict as an error, not as success.
  • Do not resend a rejected login automatically.

Next

Section titled “Next”