One Sign-In Form Still Needs More Than One Failure State
A shared form needed distinct credential, account and service errors plus validated return paths, without inventing a retry time or an unbuilt email flow
Reviewed by Dmytro Nasyrov on October 22, 2026.
A failed sign-in request used to tell the reader that their email or password was incorrect even when the server or network had failed. The form looked consistent, but the message assigned the wrong cause and encouraged the wrong next action.
One shared form, several failure meanings
The reader and admin applications adopted shared presentation components while retaining their own sign-in routes and adapters. The admin route returned structured JSON for the client to interpret. Sharing the visible form did not require flattening every response into one error.
| Service outcome | Presentation |
|---|---|
| Incorrect credentials | Inline password-area feedback |
| Inactive or disabled account | Account-state notice |
| Too many attempts | Warning without an invented retry time |
| Reader entering the staff console | Staff-only explanation |
| Server or network failure | Retryable service notice |
Retryable service feedback corrected the original bug. It let a reader retry a failed service interaction without implying that changing their password would repair the server. For throttling, the API supplied no precise retry time, so the notice avoided a countdown.
Pending state included focus behavior
While signing in, the button showed progress and the fields became read-only. Notices were announced and received focus. A meaningful message that remains outside the person's current reading position can still be missed.
Keeping the form shared made these presentation rules reusable. The application adapters still decided where to send the request and which destination was valid afterward.
The return destination was an input to validate
Accepted return paths stayed within the same application. Foreign destinations, protocol-relative forms, control characters and loops were rejected, while permitted paths were normalized. This preserved useful deep links without treating an arbitrary next parameter as trusted navigation.
Landing links also used a runtime redirect route rather than baking the deployment destination into public build-time configuration. That choice kept deployment addressing separate from the browser bundle in this implementation.
Return-path fixtures included normalized loops
Candidates were resolved against a synthetic application origin, after which the shared helper returned the resolved path, query and fragment. Checking the raw string alone would miss paths that normalize into another route. Its tests included a parent-directory segment that resolves to a refused welcome page and an encoded spelling of the sign-in route.
| Synthetic input | Expected result |
|---|---|
/profile#account |
Keep the permitted path and fragment |
/history/x/../bookmarks?tab=1#top |
Return the normalized bookmarks path with query and fragment |
/de/sign-in or /%73ign-in |
Refuse the caller's sign-in destination despite alternate spelling |
/library/../welcome |
Refuse the resolved welcome loop |
| Protocol-relative or backslash-led destination | Refuse a possible origin escape |
Both before and after resolution, the path limit was 2048 characters. A separate fixture used a space that became percent-encoded, causing a raw path within the limit to exceed it after normalization. The second length check was not redundant: the resolver can change the representation's length.
Callers supplied the refused-route list. With an empty list, the tests explicitly allowed sign-in. That is an important ownership boundary: the shared function enforces the path rule, while each flow names which otherwise local destinations would create a loop for it. It is not a universal authorization policy for every application route.
A service failure should leave the next action legible
For the visible form, a retryable service notice and an incorrect-password message have different consequences. The former should let a reader repeat the request with the same credentials. A disabled-account notice instead describes account state, and a staff-only notice describes the chosen application's audience. Combining them all under invalid credentials would assign corrective work to the reader that the current response did not justify.
Without a precise retry time in the response, the throttling notice stayed free of a countdown. We could make the warning visually consistent with the other notices without manufacturing an actionable retry timestamp.
The slice did not contain every access workflow
There was no password-reset, invitation-email or consent flow in this stage. The public form told a reader how to request access from their company administrator rather than offering an email action the implementation could not complete. The source also records a gateway-origin follow-up. A merged sign-in surface does not prove every cross-origin policy had been completed. The shared form and return-path tests establish narrower frontend behavior.
Review the cause before polishing the wording
Historical automated and browser checking accompanied the merged error mapping, shared components and navigation guards. It does not establish an account-recovery success rate or a security certification. The failure table is the useful review artifact. Each message should identify what the current response actually says and which action the reader can take. A visually unified form still needs those distinct meanings.
FAQ
Quick answers to common questions about custom software development, pricing, process and technology.
Type to filter questions and answers. Use Topic to narrow the list.
Showing all 14
No matches
Try a different keyword, change the topic or clear filters
-
How long have you been in business?
Pharos Production has been in business since 2013, with over 13 years of experience in custom software development. During this time, we have delivered over 110 applications for 200+ clients across 28 industries, including FinTech, healthcare, crypto and e-commerce. We are rated 5/5 on Clutch based on 107 verified reviews (2026).
-
What services do you provide?
Pharos Production provides six core service categories: AI Development (LLM applications, AI agents, machine learning and computer vision), Blockchain and Web3 (smart contracts, DeFi, tokenization on Ethereum, Solana, TON and other chains), FinTech Development (payment platforms, digital banking, KYC and AML integration), Software Development (mobile apps, web platforms, database design, UI/UX), Security and QA (code audits, penetration testing, smart contract audits, manual and automated testing) and Consulting (architecture design, MVP validation, startup consulting).
-
Where is Pharos Production located?
Pharos Production is headquartered in Las Vegas, Nevada, USA (5348 Vegas Dr, Las Vegas, NV 89108), with an engineering office in Kyiv, Ukraine (44-B Eugene Konovalets Str. Suite 201, Kyiv 01133). We work with clients worldwide and provide remote collaboration across all time zones. Visit our contact page for directions and scheduling options.
-
How big is your team?
Pharos Production has a team of 90+ engineers, including software developers, blockchain specialists, QA engineers, DevOps experts, UI/UX designers, project managers and solution architects. Our founder, Dr. Dmytro Nasyrov, holds a PhD in Artificial Intelligence and leads the technical direction of all projects.
-
What types of customers do you serve?
We serve a wide range of clients, from startups and product companies to mid-sized enterprises and large institutions. Our clients include crypto exchanges, FinTech providers (like Pleenk), healthcare organizations, sportsbook operators (like Pro Gambling), e-commerce platforms and SaaS companies. Pharos Production has worked with 200+ clients across 28 industries since 2013, adapting engagement models to match each client's stage, whether it is MVP validation for a startup or enterprise-scale development for an established business.
-
How is a custom software development company different from an agency?
A custom software development company like Pharos Production assigns one dedicated engineering team that owns your product across multiple release cycles, instead of handing it off once a contract ends. Agencies more often rotate staff between clients and optimize for fast delivery over long-term product ownership.
Pharos Production keeps the same team on your codebase through 2-week sprints, so there is no re-onboarding cost each time you request a new feature.
-
How much does custom software development cost?
Custom software development costs vary based on project scope and complexity. At Pharos Production, typical project ranges are: MVP development ($10,000-$25,000), suitable for startups validating a product idea; full-fledged production ($25,000-$50,000), for established businesses scaling a proven concept; and full-cycle development ($50,000-$80,000+), for complex enterprise-grade systems. These ranges include architecture design, development, QA testing and deployment. Hourly rates range from $50 to $99 depending on role and seniority. Final pricing depends on technology stack, number of integrations and engagement model (staff augmentation, dedicated team or project outsourcing).
-
How long does it take to develop a custom software application?
Development timelines depend on scope and complexity. At Pharos Production, a typical MVP takes 2-4 months, a production-ready application takes 4-8 months and a complex enterprise system can take 8-12+ months. We use an agile methodology with 2-week sprints, delivering working increments after each sprint. Every sprint includes a retrospective, progress report and planning session for the next iteration. This approach ensures transparency and allows businesses to launch faster by prioritizing high-impact features first. Get a timeline estimate for your project.
-
What industries does Pharos Production serve?
Pharos Production serves 28 industries: FinTech, MiCA Compliance, Banking, Insurance, Crypto, Healthcare, Fitness, E-Commerce, Food & Restaurant, On-Demand, Manufacturing, Automotive, Energy, Oil & Gas, Supply Chain, Construction, Real Estate, Gaming, Streaming, Media, Telecom, Education, Aviation, Travel, Logistics, Marketing, Agriculture and Recommender Systems. Our deepest expertise is in FinTech, blockchain and healthcare, where we have delivered compliance-ready platforms (HIPAA, PCI DSS, GDPR) and high-load systems handling thousands of concurrent users. For the latest industry insights, read our guides on FinTech trends in 2026 and the Web3 technology stack.
-
Why hire a software development company instead of building in-house?
Hiring a software development company offers faster time-to-market, lower upfront costs and access to specialized expertise without long-term employment commitments. According to Deloitte's 2024 Global Outsourcing Survey, 57% of companies outsource software development to access skills they cannot hire internally.
Factor In-house team Software development company Time to assemble 3-6 months (recruiting + onboarding) 1-2 weeks Upfront cost High (salaries, benefits, equipment) Lower (project-based pricing) Specialized expertise Limited to who you can hire locally Access to 90+ engineers across blockchain, AI, FinTech Scalability Slow (each new hire takes months) Fast (scale up or down per sprint) Long-term commitment Full-time employment contracts Flexible engagement models Risk High if key engineers leave Company ensures continuity and knowledge transfer For businesses that need blockchain, AI or high-load architecture expertise, outsourcing to a specialized firm like Pharos Production reduces risk and accelerates delivery.
-
What projects does Pharos Production not take on?
Pharos Production focuses on mid-to-large custom software projects with budgets starting at $10,000. We do not take on template-based websites, WordPress theme customization or short-term contracts under one month. We also do not provide non-technical staffing (marketing, sales or design-only roles). Our strongest fit is blockchain, FinTech and healthcare projects where security, compliance and high-load architecture are critical. For smaller projects or MVPs under $10,000, we recommend exploring freelance platforms or no-code tools as a more cost-effective starting point.
-
Why does Pharos Production use agile methodology?
We use agile with 2-week sprints because it reduces the risk of building features that miss the mark. Each sprint ends with a working demo, a retrospective and a plan for the next iteration.
This means clients see progress every 14 days and can adjust priorities based on real results, not assumptions. We chose this approach after years of experience showing that rigid, fixed-scope contracts lead to scope creep, missed deadlines and products that do not match market needs by launch day.
-
When should you NOT hire a custom software development company?
Custom development is not the right choice in every situation. You should not hire a custom software company if: your problem is fully solved by an existing SaaS product (e.g. Shopify for e-commerce, Salesforce for CRM); your budget is under $10,000 and timeline is under 4 weeks; you need a simple landing page or marketing website (WordPress or Webflow is faster and cheaper); or you are still validating the idea and have not spoken to potential users yet.
In these cases, off-the-shelf tools or no-code platforms offer better ROI. Custom development makes sense when you need unique workflows, regulatory compliance, high-load architecture or competitive differentiation that packaged software cannot provide.
-
What kind of projects has Pharos Production delivered?
Here are three anonymized examples from our recent delivery history:
FinTech startup - payment platform (MVP)
Scope: mobile app + backend API with bank-grade encryption. Team: 4 engineers, 1 QA. Timeline: 10 weeks. Budget: $38,000. Result: launched on schedule, processed $2M+ in transactions within the first quarter.Healthcare provider - patient portal (Full product)
Scope: HIPAA-aligned web platform with EHR integration, appointment scheduling and telemedicine. Team: 6 engineers, 1 DevOps, 2 QA. Timeline: 6 months. Budget: $120,000. Result: 15,000+ active patients, zero compliance violations in two annual audits.Crypto exchange - trading engine (Complex)
Scope: high-load matching engine handling 50,000+ orders per second, multi-chain wallet infrastructure on Ethereum and Solana. Team: 8 engineers, 2 QA, 1 security auditor. Timeline: 11 months. Budget: $340,000. Result: 99.97% uptime, passed three independent security audits.See more projects: NoMoreBets, Pulse, Sagas, Gambit Stream and Pleenk. For the full portfolio, visit our case studies. Learn more about the technology behind these projects in our guide to stablecoins and crypto infrastructure.
Stas Rysin is the Lead Frontend Developer at Pharos Production. His work covers the design system, reader interfaces and administration workflows of a professional learning platform for aesthetic medicine.
