warp-tech/warpgate

[BUG] Login asks for OTP key when none is associated with the account.

Open

#981 opened on Apr 16, 2024

View on GitHub
 (1 comment) (0 reactions) (0 assignees)Rust (281 forks)github user discovery
area/uihelp wanted

Repository metrics

Stars
 (7,061 stars)
PR merge metrics
 (Avg merge 3d 5h) (70 merged PRs in 30d)

Description

I added an OTP key to a user then realised I couldn't add it (Bitwarden wouldn't scan the QR code and it didn't display the raw hash).

I then deleted the OTP key from the account and clicked update. If I check in the admin panel there is no OTP key associated with the account, but when I want to log in with that account in the web interface, it asks for an OTP value.

Reproduction:

  1. Log in as admin
  2. Add otp key to account
  3. Click next (why is there no confirmation for the OTP key?)
  4. Save the account, but stay on the page
  5. Delete the OTP key
  6. Save the account again
  7. Log out as admin
  8. Try to log in as the changed user. Warpgate asks for an OTP key after password, which it shouldn't

I'm on version v0.9.1

Contributor guide

Research direction
Investigate the OTP validation logic in the login handler to understand why it still requests OTP after the key is deleted. Check if the database update is not propagated to the session or if the OTP requirement is cached.
Tech stack
rust
Domain
backendsecurityauthentication
Issue type
Bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
2
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Mostly clear
Prerequisites
Rust
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
70