Incorrect password while enabling 2FA does not generate any error

Summary

When enabling 2FA two pieces of information are required: the 2FA App PIN code and the GitLab.com password.

If the PIN code is incorrect, the page displays Invalid PIN code after saving the settings.

If the GitLab.com password is incorrect, the page just reloads without showing any error.

This causes a lot of confusion for customers who may be using the wrong password either because they forgot it or they have never set it up (SAML SSO workflow).

Steps to reproduce

  1. Be part of a group that has Require all users in this group to set up two-factor authentication enabled
  2. Log into a GitLab.com account without 2FA enabled.
  3. Go into User settings -> Preferences -> Account -> Enable Two-factor Authentication.
  4. Input your 2FA PIN code.
  5. Input an incorrect GitLab.com password.
  6. Click on Submit.
  7. The page reloads and does not show any error.

What is the current bug behavior?

The page reloads and does not show any error.

What is the expected correct behavior?

The page should indicate that the entered password is incorrect.

Output of checks

This bug happens on GitLab.com (as of issue creation date, 14.6.0-pre a02124bc)

Edited by Michelle Gill