Add “Email Code” option to the session-timeout MFA re-verification screen
N
Nardos Fiseha
started a topic
2 days ago
2 people like this idea
Current behavior
When a user’s session times out or they’re signed out mid-session, PMS shows a “we signed you out” pop-up with an Enter your MFA code field and a Verify MFA Code button. Users with email-based MFA have no way to request a code from this pop-up. No code gets sent automatically and there’s no “Email Code” or “Resend Code” button. The only workaround is to refresh the page, go back to the main login screen and sign in again.
The user is signed out while working.
The re-verification pop-up asks for an MFA code.
No email is sent and there’s no button to send one.
The user is stuck until they refresh and log in again from the start.
Expected behavior
Add an “Email Code” button to the pop-up (or send the code automatically when it opens) so email-MFA users can get a code without restarting the login. Add “Resend Code” with a cooldown, plus a confirmation like “Code sent to n***@domain.com”. Optional: let users pick another method (authenticator app vs. email) if they have more than one set up.
Business impact
Users think MFA is broken and switch it off, which already happened on this ticket. That weakens account security and works against the MFA rollout.
Lost time and frustration for property staff, plus avoidable support tickets as more properties turn on MFA.
Acceptance criteria
The pop-up shows an Email Code button for users enrolled in email MFA.
Clicking it sends a valid code to the user’s registered email, and entering that code restores the session without a full re-login.
Resend is rate-limited and the user sees a clear success or error message.
Authenticator-app users see no change.
2 people like this idea
Current behavior
When a user’s session times out or they’re signed out mid-session, PMS shows a “we signed you out” pop-up with an Enter your MFA code field and a Verify MFA Code button. Users with email-based MFA have no way to request a code from this pop-up. No code gets sent automatically and there’s no “Email Code” or “Resend Code” button. The only workaround is to refresh the page, go back to the main login screen and sign in again.
The user is signed out while working. The re-verification pop-up asks for an MFA code. No email is sent and there’s no button to send one. The user is stuck until they refresh and log in again from the start.
Expected behavior
Add an “Email Code” button to the pop-up (or send the code automatically when it opens) so email-MFA users can get a code without restarting the login. Add “Resend Code” with a cooldown, plus a confirmation like “Code sent to n***@domain.com”. Optional: let users pick another method (authenticator app vs. email) if they have more than one set up.
Business impact
Users think MFA is broken and switch it off, which already happened on this ticket. That weakens account security and works against the MFA rollout. Lost time and frustration for property staff, plus avoidable support tickets as more properties turn on MFA.
Acceptance criteria
The pop-up shows an Email Code button for users enrolled in email MFA. Clicking it sends a valid code to the user’s registered email, and entering that code restores the session without a full re-login. Resend is rate-limited and the user sees a clear success or error message. Authenticator-app users see no change.