admin/raven
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

case 4710 - 2FA step requires the temp token from the password step

Browse Source 
The 2FA step matched the user by temp token alone, and the token was left
empty after a successful 2FA login (null right after turning 2FA on), so an
empty or missing token skipped the password step (security review F5).
Now: an empty or missing temp token is refused before the lookup; the token is
cleared to null after success; after 5 wrong codes the token is cleared, so the
password must be entered again (counted in memory per user).

Changelog: general security notice for self-hosted upgrades, and the one
behaviour change users can see. SECURITY-REVIEW.md: F5 fixed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
John Cardinal
2026-10-24 11:28:17 -07:00
parent 27e187bac6
commit 141bdeb89c
4 changed files with 29 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
devdocs/modernization/NET10-PORT.md
View File

@@ -177,7 +177,7 @@ John's "next release" cases for AyaNova (exported 2026-10-24). Each is its own s
| Case | Name | Findings |
|---|---|---|
| 4710 | 2FA step requires the temp token (raven and sockeye) | F5, F41 |
| 4710 | 2FA step requires the temp token (raven and sockeye) | F5, F41. **raven done** (proof script 401 on both bypasses; new integration test `TwoFactor`); sockeye next |
| 4711 | Placeholder/short JWT secret treated as unset (4698 folded in: random secret generated at install, server ignores a leftover placeholder) | F1 |
| 4712 | Customer contact route allowlist + ownership checks | F13, F14, F15, F16, F17 |
| 4713 | Contact users limited to customer roles | F28 |