The product
HiNeighbour is our community platform for residential neighbourhoods, live on web, iOS and Android. Residents sign in with an email address and a password.
The report
A tester reported that signing in worked on a laptop but failed on an iPhone with the message "Invalid login credentials". That is the same message a wrong password shows.
Why it mattered
Sign in is the first step for every resident. A failure that looks like a forgotten password gets blamed on the user. People reset passwords that were never wrong, or quietly give up, and nobody reports it.
What we tested
We tested the sign in service directly, using one real account and changing one thing at a time:
| What we typed | Result |
|---|---|
| Exact email and password | Signs in |
| Email with a space at the end | Fails: Invalid login credentials |
| Password with a space at the end | Fails: Invalid login credentials |
| Email typed in capital letters | Signs in |
| Plus sign in the email replaced by a space | Fails: Invalid login credentials |
We also checked device behaviour: when you tap a keyboard suggestion on an iPhone, iOS adds a space after the word. And we tried a second phone early, because it costs nothing and quickly tells you whether a problem is the product or one device.
What we found
- The sign in service ignores capital letters in an email, but not spaces. One stray space produces exactly the same error as a wrong password.
- iPhone keyboards add that space when a suggestion is tapped, which is why a problem like this looks like it only happens on phones.
- Across the whole app, email and password fields still had autocorrect and automatic capitalisation switched on.
- The original report could not be confirmed. The same account later signed in normally from another phone, which pointed at that one device rather than the app.
What we shipped
- Email addresses are trimmed and lowercased before sign in, sign up and resending a confirmation.
- Autocorrect, automatic capitalisation and spellcheck are off on every email and password field.
- Passwords are deliberately not trimmed, because a space can genuinely be part of one. Instead, a failed sign in with spaces at either end now shows a hint, and the event is logged, so any repeat explains itself.
The lesson we bring to client work
When something works on a laptop but fails on a phone, check what the phone's keyboard inserted before suspecting the network, cookies or the session. And do not claim a fix for a bug you could not confirm: prove what can go wrong, close it, and make sure a repeat would explain itself.