Better handle 2FA setup depending on authentication state #1
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Currently the
/2fa/setuproute is always accessible, regardless of whether the user is logged in or not, and regardless of whether they have 2fa set up or not.When not logged in we should either redirect to login, and show a flash message there, or render a view with a message and with a link back to login.
If the user has 2fa set up already, then I think you typically need to remove 2fa first before you can replace it, which means first confirming 2fa or a backup code.