Page MenuHomePhabricator
Create Task
Maniphest T235645

OATHAuth requesting re-auth during the middle (or mostly just before the end) of the process
Closed, ResolvedPublic
Actions

Description

Following up on T218211 and T232008

So testing the whole thing again…

This seems to have resulted in a weird workflow, that causes it to request a username and password (ie login again) after entering the OTP onto the enabling form... When really it should be asking *before* you try and enable 2FA...

Otherwise we're getting a workflow where you enable 2FA, but then are kicked out of your account. Which doesn't seem very UX friendly... Note, it only asks for username and password, it doesn't then give the 2FA box for you to fill in

(will flesh this out a bit when I've poked around a bit more)

Details

Related Changes in Gerrit:
SubjectAuthorRepoBranchLines +/-
Ask for user re-auth only on initial requestsItSpidermanmediawiki/extensions/OATHAuthmaster+1 -1
Ask for user re-auth only on initial requestsReedymediawiki/extensions/OATHAuthREL1_34+1 -1
Customize query in gerrit

Related Objects

Event Timeline

Reedy created this task.Oct 16 2019, 1:24 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptOct 16 2019, 1:24 PM
Reedy added a parent task: T218214: SO878 Step 3: Finalize settings and user experience.Oct 16 2019, 2:36 PM
Reedy changed the task status from Open to Stalled.Oct 16 2019, 2:52 PM

And this time it requested re-auth after I clicked "enable"...

• CCicalese_WMF removed a parent task: T218214: SO878 Step 3: Finalize settings and user experience.Oct 22 2019, 7:41 PM
gerritbot added a comment.Oct 23 2019, 7:50 AM

Change 545452 had a related patch set uploaded (by ItSpiderman; owner: ItSpiderman):
[mediawiki/extensions/OATHAuth@master] Ask for user re-auth only on initial requests

https://gerrit.wikimedia.org/r/545452

gerritbot added a project: Patch-For-Review.Oct 23 2019, 7:50 AM
ItSpiderman added a comment.Oct 23 2019, 7:52 AM

This was set up to ask for re-auth only on "enable" action, but the action remains the same even after the form has been submitted, and if it happens that re-auth period expires between starting the enabling process and submitting it, then is when this issue will occur.

With the patch above, re-auth will only be checked on initial request, not on submit

Reedy closed this task as Resolved.Oct 23 2019, 2:45 PM
Reedy assigned this task to ItSpiderman.
In T235645#5597550, @ItSpiderman wrote:

This was set up to ask for re-auth only on "enable" action, but the action remains the same even after the form has been submitted, and if it happens that re-auth period expires between starting the enabling process and submitting it, then is when this issue will occur.

With the patch above, re-auth will only be checked on initial request, not on submit

Thanks! Workflow is as I'd expect now :)

gerritbot added a comment.Oct 23 2019, 2:45 PM

Change 545577 had a related patch set uploaded (by Reedy; owner: ItSpiderman):
[mediawiki/extensions/OATHAuth@REL1_34] Ask for user re-auth only on initial requests

https://gerrit.wikimedia.org/r/545577

gerritbot added a comment.Oct 23 2019, 2:49 PM

Change 545577 merged by jenkins-bot:
[mediawiki/extensions/OATHAuth@REL1_34] Ask for user re-auth only on initial requests

https://gerrit.wikimedia.org/r/545577

gerritbot added a comment.Oct 23 2019, 3:09 PM

Change 545452 merged by jenkins-bot:
[mediawiki/extensions/OATHAuth@master] Ask for user re-auth only on initial requests

https://gerrit.wikimedia.org/r/545452

Maintenance_bot removed a project: Patch-For-Review.Oct 23 2019, 3:10 PM
ReleaseTaggerBot added a project: MW-1.35-notes (1.35.0-wmf.4; 2019-10-29).Oct 24 2019, 12:00 AM
Catrope mentioned this in T401862: CVE-2025-11173: Reauth for enabling 2FA can be bypassed by submitting a form.Aug 13 2025, 7:16 PM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits