New-Network Login Codes

A password alone does not sign anyone in to ShipStream from a network that no one has verified recently. When a User signs in to the Admin UI or Client UI with a username and password from such a network, ShipStream emails them a 6-digit code and asks for it before letting them in. Someone who only has the password is stopped at that step, and the real User learns from the email that someone tried.

Logins with Social Login or Login via Badge never ask for a code. Password logins from the warehouse addresses described below do not ask for one either, except from a local address.

Known Networks

ShipStream groups addresses into networks. For IPv4, a network is every address that shares the first three numbers (for example, 203.0.113.0 to 203.0.113.255). For IPv6, it is every address that shares the first 56 bits.

A network becomes known when someone signs in from it with a password and enters the right code, or completes a password reset from it. It stays known for 90 days, and each password login that is let in because its network is known renews those 90 days.

Known networks are one list shared by everyone. Once any User, staff or a Client User of any Merchant, verifies a network, password logins from that network do not ask anyone for a code.

Signing In with a Code

1. Sign in with your username and password as usual.
2. If your network is not known, ShipStream shows a page that says We emailed a 6-digit code to j***@example.com. Enter it to finish signing in. Only the first character of the address and its domain are shown.
3. Open the email. It was sent the moment you signed in. It explains that a code is asked for because the sign-in comes from a network that no ShipStream user has verified in the last 90 days, and it shows the time, IP address and browser of that sign-in, such as Chrome on Windows. A new code from Resend Code shows the same sign-in.
4. Enter the code and click Verify. ShipStream takes you to the page you were opening, or to your start page.

Each code works once and expires after 10 minutes. Until the code is entered, the session can only show the code page, send a new code or log out.

If you checked Keep me logged in, it takes effect once the code is entered. Until then the browser keeps the sign-in only as long as a sign-in without that box, so a sign-in that never gets its code is not kept for days.

To leave without entering the code, use the Not you? Log out link on the code page. If you get a code email without having tried to sign in, your password was used by another person: reset it with Forgot your password? on the login page. The email's Reset your password link, under If this was not you, opens the same page. Opened in the browser that is waiting for the code, the link signs that sign-in out first, as Not you? Log out would.

Requesting a New Code

Click Resend Code on the code page to get a new code. The new code replaces the one you had.

ShipStream sends at most 3 codes to a User in any 15 minutes, counting the first one, so a third resend in that time is refused with You can request a new code in 12 minutes. (showing the minutes left).

Wrong Codes

• A wrong code shows That code is not right. Try again.
• After 5 wrong codes for one sign-in, ShipStream signs that session out and shows Too many wrong codes. Please sign in again. Requesting a new code does not reset this count.
• After 10 wrong codes for the same User within an hour, across any number of sign-ins, ShipStream stops checking that User's codes for 15 minutes and shows Too many wrong codes. Try again in N minutes., where N is the number of minutes left. New codes can still be requested during that time.
• An expired code shows The code has expired. and does not count as a wrong code; ShipStream emails a new code when it can.

Which Logins Are Checked

Password logins on the Admin UI, the Client UI and the Scanner UI are checked.

The new WMS GUI login page cannot take the code yet. From a network that is not known:

• An Admin UI user is shown This sign-in needs a login code sent to your email address. Continue in ShipStream to enter it. Open the Admin UI in the same browser to enter the code there.
• A Client User is shown Sign in on the client portal to receive your code., is sent no code and is not signed in to the new WMS GUI. Signing in on the Client Portal login page sends the code.

These logins do not ask for a code:

• Social Login with Google or Microsoft.
• Login via Badge.
• Password logins from an IP address listed in Warehouse Remote IPs (System -> Configuration -> Warehouse -> Operations -> Restrictions). Enter addresses or CIDR ranges, separated by spaces, commas or new lines. A password login from a listed address does not ask for a code and does not add its network to the known networks. A password login from a local address, such as 127.0.0.1, always asks for a code, even when the address is listed: a local address is never treated as a known network. Host names in that list do not count.
• Integrations that connect with API credentials.

Settings

The check is on by default, with one setting for each kind of User:

• Admin UI users - System -> Configuration -> Advanced -> Admin, group Login Security, Email a Code for Logins from New Networks. It is managed by ShipStream; contact support to change it.
• Client Users of every Merchant - System -> Configuration -> Clients -> Security, group Sign-In, Email a Code for Logins from New Networks. It is one setting for all Merchants. Only Admin UI users with access to this section can change it, so Client Users cannot turn it off.

Which setting applies depends on the User, not on the login page they use.

Turning a setting off signs out the sessions of its Users that are waiting for a code, the next time they load a page; they can then sign in again without one.

While a setting is off, the password logins of its Users are not checked, and they neither add networks to the list nor renew the ones they use, but a completed password reset still does. Networks already on the list stay known for both kinds of User.

What the Server Needs

ShipStream counts codes in a Redis service, the rate limiter connection in the ratelimiter section of the server's local.xml. The settings above say whether you want the check; this connection decides whether it can run:

• No connection configured - the check is inactive, whatever the settings say. Password logins from new networks sign in without a code, as they do while a setting is off, and ShipStream writes a warning to its log at most once an hour. A session that was waiting for a code is signed out the next time it loads a page.
• Connection configured but the service is down - the check stays on. Logins that need a code wait on the code page until the service is back (see If the Code Does Not Arrive), so an outage never lets a login through without its code.

Codes also need email. Whether ShipStream sends email is not set on the configuration page, so no administrator can turn email off to skip the codes; contact support to turn it off or back on, or, on a self-hosted site, set it in the server's local.xml. While email is off, no code can be sent: password logins from new networks sign in without a code, as they do while a setting is off, and a session that was waiting for a code is signed out the next time it loads a page.

When Networks Are Forgotten

A User's own entries in the list are removed when their password changes, whether they change it, an administrator changes it or they reset it, and when the User is deactivated or deleted. Archiving a Merchant does not remove the entries of its Client Users; they expire after 90 days without use. A password reset then adds the network the reset was completed from. Changing only the username or email address keeps the entries, and reactivating a User does not bring them back.

A network that other Users have verified stays known through their entries. A network that only this User had verified is no longer known, even for the coworkers who sign in from it every day: a password login that is let in because its network is known does not add an entry for that User. The next person to sign in from it with a password is asked for a code once, and entering it makes the network known for everyone again.

When ShipStream Started Checking

When this check was introduced, most networks that active Users had signed in from during the previous week, by any login method, were added to the list. A network that was not added asks for a code the first time someone signs in from it with a password.

Users who were already signed in at that time were checked on the next page they opened, and asked for a code if their network was not known; after the code they were taken to their start page. Sessions on record as signed in with Social Login or a badge were not asked; a session older than that record was checked like a password login.

If the Code Does Not Arrive

• Check your spam or junk folder. The email's subject ends with login code.
• Click Resend Code for a new code, up to 3 codes in 15 minutes.
• If the page shows We could not send the code. Try again., the email could not be sent. Refreshing the page does not send another code; click Resend Code to try again. Each try counts toward the 3 codes in 15 minutes.
• If the email address on your User account is out of date, ask an administrator to correct it on the User edit page.
• If Social Login is set up for you, use Not you? Log out on the code page, then sign in with Google or Microsoft; those logins never ask for a code.
• Administrators: login code emails are sent at once, not through the mail queue, so they are not listed under System -> Email -> Mail Queue.

If the page shows We cannot check codes right now. Try again in a few minutes., the service ShipStream uses to count codes is unavailable. No code is sent or checked until it is back, and logins that do not need a code are not affected.

Failed password attempts are limited separately; see Login Throttling.