Repository navigation
Ask one step-up factor instead of password and code - #4
Merged
Merged
Conversation
Admins found password plus 2FA code too much for actions in a session that already proves the password. Step-ups (Approvals, adding, inviting and deleting admins, the email, mail and remote backup settings, tokens, runner tokens, agent keys and webhooks, turning 2FA off) now go through one helper, users::verify_step_up: with 2FA the current code (used up, failures counted as before), without 2FA the password; the other field is ignored. Approvals keep which items can be confirmed in the panel. The mail-link page and changing the password keep their factors. The webui's prompts show only the code field with 2FA, else only the password field; callers still send both. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A try refused by the lock still went through attempt_failed, which started the count over at 1, so the next tries were allowed again and the 15 minutes never held. With one step-up factor the session alone reaches the code check, so a stolen session could have guessed 2FA codes without a real limit. A refused try now leaves count and wait as they are; after the wait the entry is dropped and the count restarts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The mail-link approval did its own code-or-password check and the Approvals requests declared password and code by hand; they now flatten users::StepUp and go through verify_step_up and verify_approval. The message box resets its value with each new box, a code-only box sent the text of the last one as the password. Stale comments about password and code fixed, the mail settings test no longer uses a fixed code that could be valid. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The operator found password plus 2FA code too much: the session already proves the password. Step-ups (Approvals and proposal approval in the panel, admin management, turning 2FA off, email change, mail settings, remote backup settings and password, API/runner tokens, agent keys, webhooks, mail-off confirmations) now ask one extra factor through users::verify_step_up: the TOTP code for an admin with 2FA (used up, failures counted, password ignored), the password for an admin without 2FA. Which Approvals items can be confirmed in the panel is unchanged (2FA, or created with mail off). Unchanged: the mail-link pages (no session: code with 2FA, else password) and changing the password (needs the current one). The webui prompt shows only the field that is asked.
Checks: prettier, svelte-check, webui build, cargo fmt --check, clippy, cargo test (293). Not clicked through in a browser.