Nice find!

Wikitech 2FA is also bypassed by Gerrit and Phabricator in all operations. The effort I went to to support the spirit of Wikitech 2FA in Striker was pretty large, and honestly I'm not really convinced that it was worth it. If there is any fix here it is probably figuring out how to completely disable the contrib-admin login flow.

In T284400#7139965, @bd808 wrote:

Wikitech 2FA is also bypassed by Gerrit and Phabricator in all operations. The effort I went to to support the spirit of Wikitech 2FA in Striker was pretty large, and honestly I'm not really convinced that it was worth it. If there is any fix here it is probably figuring out how to completely disable the contrib-admin login flow.

That was my thinking. I actually didn't notice this interface was even there. The interface looks like it could even be useful, but that doesn't mean it totally fits the security model of the site.

In T284400#7140368, @Bstorm wrote:

I actually didn't notice this interface was even there.

It is not linked anywhere in the public UI. It is semi-obvious if you are used to doing Django development and look at the urls.py router setup.

The interface looks like it could even be useful, but that doesn't mean it totally fits the security model of the site.

The /contrib-admin/ route exposes Django's https://docs.djangoproject.com/en/2.2/ref/contrib/admin/ which can be much nicer to use than direct db calls when browsing the db as a "root" user.

Following https://docs.djangoproject.com/en/2.2/ref/contrib/admin/#root-and-login-templates and setting up a login template and form that doesn't actually log you in would be one way to disable the login here. In theory these same settings could be used to replace the default form and auth flow too, but I'm not sure that is actually needed.