https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=44007
Bug ID: 44007
Summary: Limit attempts and resends on the two-factor
authentication second step
Initiative type: ---
Sponsorship ---
status:
Product: Koha
Version: Main
Hardware: All
OS: All
Status: NEW
Severity: normal
Priority: P5 - low
Component: Authentication
Assignee: [email protected]
Reporter: [email protected]
QA Contact: [email protected]
CC: [email protected]
Target Milestone: ---
The staff login second step accepts any number of OTP guesses, and the "Send
the code by email" endpoint can be called repeatedly. TOTP codes are also
replayable within their validity window.
This matters more once users can enrol by email only (Bug 44006), where the
emailed code is their sole second factor.
Proposed:
- cap failed OTP attempts per login session, then require a fresh login
- add a cooldown between email sends
- review the validity window used for emailed codes (currently the global
mfa_range, about 90 seconds, which is tight for email delivery)
Test plan:
1. Enable 2FA and enrol a user.
2. At the second step, enter wrong codes repeatedly: after the cap the session
is rejected and a new login is required.
3. Press "Send the code by email" repeatedly: sends within the cooldown are
refused.
4. A correct code within the limits still logs in.
--
You are receiving this mail because:
You are watching all bug changes.
You are the assignee for the bug.
_______________________________________________
Koha-bugs mailing list -- [email protected]
To unsubscribe send an email to [email protected]
website : http://www.koha-community.org/
git : http://git.koha-community.org/
bugs : http://bugs.koha-community.org/
