Add stricter client-side mobile number validation in self-registration#10125
Open
Sithumli wants to merge 3 commits intowso2:masterfrom
Open
Add stricter client-side mobile number validation in self-registration#10125Sithumli wants to merge 3 commits intowso2:masterfrom
Sithumli wants to merge 3 commits intowso2:masterfrom
Conversation
…n" -m "Update mobile number validation regex to enforce E.164 international format requiring 10-15 digits. This prevents invalid phone numbers from being submitted and failing silently on the backend." -m "Fixes: wso2/product-is#27211
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughUpdated self-registration form to add client-side validation for username and mobile number fields with E.164 format enforcement. Modified field DOM IDs and event handlers, and added a changesets entry documenting the patch release. Changes
Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (2 inconclusive)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
🧹 Nitpick comments (1)
identity-apps-core/apps/recovery-portal/src/main/webapp/self-registration-username-request.jsp (1)
1179-1181: Consider avoiding repeated mobile-claim URI literals here.This condition now carries behavior-critical branching; extracting the mobile claim URI into a single local constant in this JSP would reduce drift risk across the other
http://wso2.org/claims/mobilechecks in the same file.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@identity-apps-core/apps/recovery-portal/src/main/webapp/self-registration-username-request.jsp` around lines 1179 - 1181, Extract the hard-coded mobile claim URI literal "http://wso2.org/claims/mobile" into a single local constant and use it wherever the literal appears; for example, declare a final String MOBILE_CLAIM_URI = "http://wso2.org/claims/mobile" near the top of the JSP and replace occurrences in the conditional that uses claim.getValidationRegex() and claim.getUri() (and any other checks against the mobile claim) to compare against MOBILE_CLAIM_URI instead of the string literal.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In
`@identity-apps-core/apps/recovery-portal/src/main/webapp/self-registration-username-request.jsp`:
- Around line 1179-1181: Extract the hard-coded mobile claim URI literal
"http://wso2.org/claims/mobile" into a single local constant and use it wherever
the literal appears; for example, declare a final String MOBILE_CLAIM_URI =
"http://wso2.org/claims/mobile" near the top of the JSP and replace occurrences
in the conditional that uses claim.getValidationRegex() and claim.getUri() (and
any other checks against the mobile claim) to compare against MOBILE_CLAIM_URI
instead of the string literal.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: CHILL
Plan: Pro
Run ID: 911a5390-7b9a-4a97-abad-d364788406a0
📒 Files selected for processing (9)
identity-apps-core/apps/recovery-portal/src/main/resources/org/wso2/carbon/identity/mgt/recovery/endpoint/i18n/Resources.propertiesidentity-apps-core/apps/recovery-portal/src/main/resources/org/wso2/carbon/identity/mgt/recovery/endpoint/i18n/Resources_de_DE.propertiesidentity-apps-core/apps/recovery-portal/src/main/resources/org/wso2/carbon/identity/mgt/recovery/endpoint/i18n/Resources_es_ES.propertiesidentity-apps-core/apps/recovery-portal/src/main/resources/org/wso2/carbon/identity/mgt/recovery/endpoint/i18n/Resources_fr_FR.propertiesidentity-apps-core/apps/recovery-portal/src/main/resources/org/wso2/carbon/identity/mgt/recovery/endpoint/i18n/Resources_ja_JP.propertiesidentity-apps-core/apps/recovery-portal/src/main/resources/org/wso2/carbon/identity/mgt/recovery/endpoint/i18n/Resources_pt_BR.propertiesidentity-apps-core/apps/recovery-portal/src/main/resources/org/wso2/carbon/identity/mgt/recovery/endpoint/i18n/Resources_pt_PT.propertiesidentity-apps-core/apps/recovery-portal/src/main/resources/org/wso2/carbon/identity/mgt/recovery/endpoint/i18n/Resources_zh_CN.propertiesidentity-apps-core/apps/recovery-portal/src/main/webapp/self-registration-username-request.jsp
Contributor
There was a problem hiding this comment.
Pull request overview
This PR tightens client-side validation for the self-registration mobile number field to better align with backend expectations and avoid backend-side validation failures.
Changes:
- Skip applying server-provided
patternvalidation regex for the mobile claim field in the self-registration form. - Replace the existing permissive
mobilePatternwith a strict E.164 regex (^\+[1-9]\d{9,14}$). - Add new i18n keys for email/username format errors across multiple locales.
Reviewed changes
Copilot reviewed 9 out of 9 changed files in this pull request and generated 10 comments.
Show a summary per file
| File | Description |
|---|---|
| identity-apps-core/apps/recovery-portal/src/main/webapp/self-registration-username-request.jsp | Avoids applying claim regex pattern to the mobile field and enforces E.164 format via JS validation. |
| identity-apps-core/apps/recovery-portal/src/main/resources/org/wso2/carbon/identity/mgt/recovery/endpoint/i18n/Resources.properties | Adds new email/username format error strings; existing mobile format message remains. |
| identity-apps-core/apps/recovery-portal/src/main/resources/org/wso2/carbon/identity/mgt/recovery/endpoint/i18n/Resources_zh_CN.properties | Adds localized email/username format error strings. |
| identity-apps-core/apps/recovery-portal/src/main/resources/org/wso2/carbon/identity/mgt/recovery/endpoint/i18n/Resources_pt_PT.properties | Adds localized email/username format error strings. |
| identity-apps-core/apps/recovery-portal/src/main/resources/org/wso2/carbon/identity/mgt/recovery/endpoint/i18n/Resources_pt_BR.properties | Adds localized email/username format error strings. |
| identity-apps-core/apps/recovery-portal/src/main/resources/org/wso2/carbon/identity/mgt/recovery/endpoint/i18n/Resources_ja_JP.properties | Adds localized email/username format error strings. |
| identity-apps-core/apps/recovery-portal/src/main/resources/org/wso2/carbon/identity/mgt/recovery/endpoint/i18n/Resources_fr_FR.properties | Adds localized email/username format error strings. |
| identity-apps-core/apps/recovery-portal/src/main/resources/org/wso2/carbon/identity/mgt/recovery/endpoint/i18n/Resources_es_ES.properties | Adds localized email/username format error strings. |
| identity-apps-core/apps/recovery-portal/src/main/resources/org/wso2/carbon/identity/mgt/recovery/endpoint/i18n/Resources_de_DE.properties | Adds localized email/username format error strings. |
Comments suppressed due to low confidence (1)
identity-apps-core/apps/recovery-portal/src/main/webapp/self-registration-username-request.jsp:1186
- This adds another hard-coded mobile claim URI string. Since this JSP already uses
IdentityManagementEndpointConstants.ClaimURIs.*for other claims, consider using the existingMOBILE_CLAIMconstant here as well to avoid typos and keep claim URI handling centralized.
onblur="showFieldValidationStatus(this)"
oninput="hideFieldValidationStatus(this)"
<% if (claim.getValidationRegex() != null && !StringUtils.equals(claim.getUri(), "http://wso2.org/claims/mobile")) { %>
pattern="<%= Encode.forHtmlContent(claim.getValidationRegex()) %>"
<% } %>
<% if (claim.getRequired()) { %>
required
<% } %>
<% if (StringUtils.equals(claim.getUri(), "http://wso2.org/claims/mobile")) { %>
id="mobileNumber"
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
…g email and username format error messages and adding mobile number validation with E.164 format support across multiple language resources.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
Add stricter client-side mobile number validation in the self-registration flow to prevent invalid phone numbers from being submitted and causing backend validation failures with generic error pages.
Changes:
mobilePatternregex/^\s*(?:\+?(\d{1,3}))?[-. (]*(\d{3})?[-. )]*(\d{3})?[-. ]*(\d{4,6})(?: *x(\d+))?\s*$//^\+[1-9]\d{9,14}$/Validation behavior:
+94712345678(valid Sri Lanka)+12025551234(valid USA)+942560025(too short)1234abcd(invalid)Related Issues
Related PRs
Checklist
Security checks
Developer Checklist (Mandatory)
product-isissue to track any behavioral change or migration impact.WSO2.Identity.Server.-.Google.Chrome.2026-04-12.13-10-51.mp4