I’m building a web app in Bubble designed primarily for children, but the parent is the one who signs up and owns the account.
Inside the app, there will be a Parent Dashboard that I don’t want children to access accidentally. I’d like this area to be re-protected by the same account password (no separate parent password).
My current idea is:
The parent clicks a Parent Dashboard button
A popup appears asking the parent to re-enter the account password
If the password is correct, the user is taken to the Parent Dashboard
My questions:
Is there a recommended way in Bubble to re-authenticate a logged-in user like this?
Is using a popup to request the account password a good practice?
Are there better or more secure approaches for this scenario?
Any guidance or best practices would be really helpful. Thanks!
I have a workaround in mind for this. You can use the update the user’s credentials action and set the new password as the old password itself (this would be the Input field where the user is entering their current password). This way, if the password is entered again and is correct, the action’s result would be successful
You can just use the “Check user’s password” action for this purpose The workflow will error if it’s incorrect so place the logic you want to happen after password is entered after this action.
If false it will return an error. This by default shows a browser alert, but you can also have another workflow ‘When unhandled error occurs’ which shows an alert.
That’s great thank you I didn’t realise you could do that separate work flow. That means I could also do the password check based on the page load rather than button pressed. Great help mate
I think from a UX perspective you should have a separate parental pin for such purposes as that’s much easier for a parent to recall and quickly enter. There’s a reason why all of the dozens of streaming apps I have for my kids do it this way…
To be fair, the answer is how old are the kids, as that determines how secure you want to make it.
If they are only 6, then just define the PIN on the parent’s user type and check that. But if they’re 14 and technically curious, then hide that PIN via privacy rules and query it from the backend via the API connector to check that it’s correct.
It’s ages 4-8 so would more than likely get away with the easier option. How would I do the check a workflow on something like if Input == parent pin → navigate to page