Multi-factor authentication: The second factor can be skipped
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 40/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Stale
- Domain
- authentication, backend, security
Research direction
Start by locating the test containing mfaWhenWrongCodeThenRedirects and mfaWhenSecondFactorSkippedThenRedirects, then run the latter to reproduce the failure. Trace the /third-factor request after formLogin() redirects to /second-factor. Done means the skipped second-factor submission redirects to /login?error rather than /.
Written by the indexing model from the issue text.
Description
Simply remove the second factor part from mfaWhenWrongCodeThenRedirects and the test fails:
@Test
void mfaWhenSecondFactorSkippedThenRedirects() throws Exception {
// @formatter:off
MvcResult result = this.mockMvc.perform(formLogin()
.user("user@example.com")
.password("password"))
.andExpect(redirectedUrl("/second-factor"))
.andReturn();
HttpSession session = result.getRequest().getSession();
// skip the second factor
this.mockMvc.perform(post("/third-factor")
.session((MockHttpSession) session)
.param("answer", "smith")
.with(csrf()))
.andExpect(redirectedUrl("/login?error"));
// @formatter:on
}
Test output:
Redirected URL expected:</login?error> but was:</>
Expected :/login?error
Actual :/
- Dominant language
- Java
- Stars
- 1.8k
- Forks
- 797
- Avg merge
- 3m
- Merged PRs (30d)
- 5
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from spring-projects/spring-security-samples
-
Difficulty 1/5 1-3 hours Newbie friendliness 86/100
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
-
Difficulty 5/5 Over a week Newbie friendliness 25/100
spring-projects/spring-security-samples#353 · 1 comment ·
-
Difficulty 5/5 Over a week Newbie friendliness 25/100
-
type: enhancement
spring-projects/spring-security-samples#347 · 2 comments · 1 assignee ·
All issues in spring-projects/spring-security-samples
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
infinispan/infinispan#18150 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
-
untriaged
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
opensearch-project/k-NN#3597 ·
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 82/100