Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(auth): Fix problem of BadSignature in django two factor auth library #19351

Merged
merged 1 commit into from
Dec 20, 2023

Conversation

webjunkie
Copy link
Contributor

@webjunkie webjunkie commented Dec 15, 2023

Problem

The hashing involved in the remember 2FA cookie might change when we upgrade Django (or due to other reasons). When the user has such a cookie to remember 2FA, meaning they would log in and expect to skip 2FA, they will get instead an error message and no way to continue. The solution for the user would be to delete the cookie.

What ideally should happen: The user continues and skips 2FA since the cookie is valid.
What at least can happen: The user can continue and enters 2FA. This is what the PR provides.

Fixes #19350
Fixes POSTHOG-DJW

Caused by jazzband/django-two-factor-auth#686

Changes

How did you test this code?

  • recreated the login and cookie locally by enabling 2FA
  • upgrade to Django 4.1 using the commit that has it from master
  • observing the error etc.

@webjunkie webjunkie marked this pull request as ready for review December 18, 2023 08:38
@webjunkie
Copy link
Contributor Author

@benjackwhite Can you take a quick look?

@webjunkie webjunkie merged commit 87fdf3f into master Dec 20, 2023
76 checks passed
@webjunkie webjunkie deleted the fix/django-2fa-badsignature branch December 20, 2023 08:23
fuziontech pushed a commit that referenced this pull request Jan 4, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Workaround Needed for Cookie Validation Issue During Django Upgrade
2 participants