Comments (6)
@mesbahmilad This can be solved by overriding the Devise RegistrationsController in your app (or any other controller where you want to enforce 2FA), and adding a before_action
, such as:
before_action :confirm_two_factor_authenticated, except: [:new, :create, :cancel]
def confirm_two_factor_authenticated
return if is_fully_authenticated?
flash[:error] = t('devise.errors.messages.user_not_authenticated')
redirect_to user_two_factor_authentication_url
end
from two_factor_authentication.
This is a pretty huge security flaw. You can sign in without 2FA, go to the edit page and disable 2FA from there. I'd recommend adding a note in the README at least.
from two_factor_authentication.
This note should definitely be added to the readme, as a post-setup installation note. Can the gem be secured internally, though?
from two_factor_authentication.
Thanks for your report, could you please provide some example?
from two_factor_authentication.
Example:
If the devise model is "user", once logged in you are presented with the two-factor authentication wall to enter the code. From here you can navigate to "users/edit" and since this is a devise controller the gem skips code validation.
Once in the edit view you can edit the user information without being authorized with the code.
Ps. Great gem!
from two_factor_authentication.
I made a PR, here:
I'm not sure why it failed travis-CI, I only updated the readme...
from two_factor_authentication.
Related Issues (20)
- TOTP Codes Entered With Spaces Break Authentication
- Need to upgrade or lock rotp at v3.x HOT 6
- Rails 5.2 Support??
- Manual setup and generator setup are different HOT 1
- Followed guidelines but can't use it.
- Use activeadmin layout
- rotp breaking changes
- Rails 6.1 deprecation warning
- How to turn off two-factor for non password logins i.e. token?
- Add to existing project
- How to encrypt direct otp?
- Upgrading from v1.1.5 to v2.x issues - encrypted_otp_secret_key is nil
- Request for support for backup codes
- Use with Pundit HOT 3
- is_fully_authenticated? returns true when the user model is not called user HOT 2
- 500 error on invalid 2fa code, if user has never authenticated successfully before.
- Is this project dead? HOT 19
- Support for Encryptor 3 - AKA ArgumentError (must specify a key) HOT 1
- Run tests
- Do we need uniqueness index for encrypted_otp_secret_key?
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from two_factor_authentication.