2

I'm trying to draw a UML activity diagram for the functionality of a user retrieving his password when she has forgotten it. It looks like this:

enter image description here

As you can see, this functionality requires two requests at different stages, one for the input of the username, the other for the input of the verification code. So the whole procedure could be divided into two sub-procedures each representing a single request and response pair. That's why I wonder whether I should use one or two activity diagrams to illustrate this functionality. Should an activity diagram correspond to a single functionality or to a single request/response pair?

In my opinion, the former one brings completeness, but increases complexity. The complexity could be solved by the latter one, but it also brings partition and dependency issues. It's hard to decide for me, please give me some suggestions.

Improve this question
8
  • 3
    It's a security breach to display "user not found". That allows fishing for valid user names. Instead just display "If you are a registered user, then a code has been sent to your phone."
    – kevin cline
    May 3, 2016 at 6:37
  • Who is going to look at this diagram? There are two sub procedures, but they need to be in order. Instead of providing the password, you should have the user create a new one for security reasons..
    – JeffO
    May 3, 2016 at 16:21
  • @JeffO It's only me who look at this diagram as I'm learning UML currently. As to the password, I just use the actual one to make the scenario simple.
    – Ivan
    May 4, 2016 at 11:25
  • 4
    Wait how can you display user's password ? Are you storing them in plain text ?
    – Walfrat
    Apr 27, 2017 at 12:44
  • 1
    Many companies end up storing passwords in plain text "to make the scenario simple". There should be corporal punishment for CEOs, managers and developers in those companies. You will get trouble for just mentioning the possibility because this is something that must be stamped out.
    – gnasher729
    May 27, 2017 at 20:41

2 Answers 2

Reset to default
1

Using one or two diagrams depends on what you want to show:

  1. The behaviour of the whole functionality
  2. What the system should do when a certain request comes in

For me it seems logical to make one activity diagram of the whole functionality. Then if you feel the need to go into details of what the system does when receiving a certain request, do nr 2 also. Maybe then a sequence diagram would be the apropriate level, as you want to show the request and which entities (e.g. java classes) will participate in processing it. In this case, maybe you could write the code without making a diagram, but as a practice you can make a simple sequence diagram to see the differences between activity and sequence diagram and how they relate. Happy learning! :-)

Improve this answer
0

Brilliant design. So any hacker can use your "forgot password" feature to determine which usernames are in use. Just type in a username, press "forgot password", and if the hacker gets an error then it is an invalid username.

What's ten times worse is that apparently you can display the user's password. That is criminally negligent. You must never, ever, in a million years be able to display a user's password. If you can, then a hacker breaking into your systems can display it. What you store is a hash of the salted password. And if you don't know what a hash of the salted password is, then stay away from handling passwords until you know and can implement it.

The correct way to handle "forgotten password" is not to tell the user, but to allow them to enter a new password. And for that, the verification code must only work for a limited time, because if it works for say an hour that might give a hacker an opportunity to get hold of the phone, read the verification code, and change the password to one of his choice.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.