Better handle 2FA setup depending on authentication state #1

Open
opened 2025-10-31 08:47:49 +00:00 by arne · 0 comments
Owner

Currently the /2fa/setup route is always accessible, regardless of whether the user is logged in or not, and regardless of whether they have 2fa set up or not.

When not logged in we should either redirect to login, and show a flash message there, or render a view with a message and with a link back to login.

If the user has 2fa set up already, then I think you typically need to remove 2fa first before you can replace it, which means first confirming 2fa or a backup code.

Currently the `/2fa/setup` route is always accessible, regardless of whether the user is logged in or not, and regardless of whether they have 2fa set up or not. When not logged in we should either redirect to login, and show a flash message there, or render a view with a message and with a link back to login. If the user has 2fa set up already, then I think you typically need to remove 2fa first before you can replace it, which means first confirming 2fa or a backup code.
Sign in to join this conversation.
No labels
bug
small
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
gaiwan/Oak#1
No description provided.