Fix two factor auth only working on the second try. - #700
Merged
steinkel merged 3 commits intoJun 20, 2018
Conversation
added 3 commits
June 13, 2018 21:51
This patch ensures that a new secret is only generated in case the user record doesn't already has a secret set.
Ensures that the user data is persisted in the storage configured for the Auth component, and that the `secret_verified` flag is set properly.
Codecov Report
@@ Coverage Diff @@
## master #700 +/- ##
============================================
+ Coverage 80.37% 81.64% +1.26%
Complexity 543 543
============================================
Files 52 52
Lines 1692 1694 +2
============================================
+ Hits 1360 1383 +23
+ Misses 332 311 -21
Continue to review full report at Codecov.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When no secret is set for a user, a new one is being generated and stored in the user record, however it's not being set in the session, so that on the subsequent POST request the secret is still not there, and a new one is being generated, which causes the verification to use the wrong secret.
After such a failed attempt the secret is present in the user record and will be fetched in
LoginTrait::_afterIdentifyUser(), making it available in the session data so that no new secret is being generated, and the verification works.