Maniphest T420201

OATHAuth: Add support for expiring recovery codes
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	mszwarc
	Mar 16 2026, 12:22 PM

Project Tags

Referenced Files

None

Subscribers

Description

For the parent task, we need to implement support for expiring recovery codes at all. "Normal" recovery codes, which are generated by the user for themself, should remain valid indefinitely.

Acceptance criteria

Expiring recovery codes can be used to log in to the account only before their expiration time.
Expiring recovery codes are not listed (nor downloadable) on Special:AccountSecurity.
Expiring recovery codes are single-use.
Expired recovery codes are removed from the database as soon as any write operation happens to the user's recovery codes (e.g., other code was used).
Expiring recovery codes are also removed when the user is regenerating their codes.

Details

Related Changes in Gerrit:

Subject	Author	Repo	Branch	Lines +/-
Fix encryption of recovery codes with data	Mszwarc	mediawiki/extensions/OATHAuth	master	+24 -6
Hide expiring recovery codes from Special:AccountSecurity	Mszwarc	mediawiki/extensions/OATHAuth	master	+42 -15
Add optional expiration timestamp to recovery codes	Mszwarc	mediawiki/extensions/OATHAuth	master	+138 -9
Extract a class for single recovery code	Mszwarc	mediawiki/extensions/OATHAuth	master	+331 -126

Customize query in gerrit

Related Objects
Search...

Status	Assigned	Task
		Restricted Task
Open	None	T150898 Force OATHAuth (2FA) for certain user groups in Wikimedia production and Beta wikis
Resolved	mszwarc	T414907 Enforce 2FA-requiring groups using $wgRestrictedGroups
		Restricted Task
		Restricted Task
Resolved	mszwarc	T415883 Create a special page to generate additional recovery keys for other users
Resolved	mszwarc	T420200 Special:Recover2FAForUser should generate short-lived recovery codes
Resolved	mszwarc	T420201 OATHAuth: Add support for expiring recovery codes

Event Timeline

mszwarc created this task.Mar 16 2026, 12:22 PM

mszwarc moved this task from Backlog to Ready on the Product Safety and Integrity (Sprint Crocus (Mar 2 - Mar 20)) board.

neriah subscribed.Mar 16 2026, 10:46 PM

mszwarc moved this task from Ready to In progress on the Product Safety and Integrity (Sprint Crocus (Mar 2 - Mar 20)) board.Mar 17 2026, 9:48 AM

Change #1254179 had a related patch set uploaded (by Mszwarc; author: Mszwarc):

[mediawiki/extensions/OATHAuth@master] Extract a class for single recovery code

https://gerrit.wikimedia.org/r/1254179

gerritbot added a project: Patch-For-Review.Mar 17 2026, 12:05 PM

Change #1254202 had a related patch set uploaded (by Mszwarc; author: Mszwarc):

[mediawiki/extensions/OATHAuth@master] Add optional expiration timestamp to recovery codes

https://gerrit.wikimedia.org/r/1254202

mszwarc moved this task from In progress to Needs review on the Product Safety and Integrity (Sprint Crocus (Mar 2 - Mar 20)) board.Mar 17 2026, 3:12 PM

Reedy moved this task from Backlog to Features/Improvements on the MediaWiki-extensions-OATHAuth board.Mar 18 2026, 8:25 PM

Change #1254179 merged by jenkins-bot:

[mediawiki/extensions/OATHAuth@master] Extract a class for single recovery code

https://gerrit.wikimedia.org/r/1254179

ReleaseTaggerBot added a project: MW-1.46-notes (1.46.0-wmf.21; 2026-03-24).Mar 19 2026, 7:00 PM

Change #1254202 merged by jenkins-bot:

[mediawiki/extensions/OATHAuth@master] Add optional expiration timestamp to recovery codes

https://gerrit.wikimedia.org/r/1254202

Maintenance_bot removed a project: Patch-For-Review.Mar 19 2026, 7:31 PM

Change #1254222 merged by jenkins-bot:

[mediawiki/extensions/OATHAuth@master] Hide expiring recovery codes from Special:AccountSecurity

https://gerrit.wikimedia.org/r/1254222

Expiring recovery codes are not listed (nor downloadable) on Special:AccountSecurity.

User should be able to notice their existence and be able to remove them. Otherwise if malicious user try to recover their 2FA (more common if we grant 2FA recovery permission to sysops) user will have no way to combat that.

mszwarc mentioned this in T420908: OATHAuth: Indicate that the user has temporary recovery codes.Mar 23 2026, 10:53 AM

In T420201#11735570, @Bugreporter wrote:

Expiring recovery codes are not listed (nor downloadable) on Special:AccountSecurity.

User should be able to notice their existence and be able to remove them. Otherwise if malicious user try to recover their 2FA (more common if we grant 2FA recovery permission to sysops) user will have no way to combat that.

Yes, I'd like to make a difference between listing the codes and indicating the existence of them.

For the first – we don't want to encourage users to store temporary codes, because they would expire soon. That's why the codes themselves shouldn't be available from the special page.

For indicating the existence of such codes – this idea is valid (I've also mentioned it in one of the commit messages, for lack of time to create a proper task). This is something that should be implemented (T420908).

mszwarc closed this task as Resolved.Mar 23 2026, 10:58 AM

mszwarc moved this task from Needs review to Done on the Product Safety and Integrity (Sprint Crocus (Mar 2 - Mar 20)) board.

mszwarc updated the task description. (Show Details)

Reedy mentioned this in T420994: Add a maintenance script to purge temporary recovery codes.Mar 23 2026, 7:53 PM

Change #1259891 had a related patch set uploaded (by Mszwarc; author: Mszwarc):

[mediawiki/extensions/OATHAuth@master] Fix encryption of recovery codes with data

https://gerrit.wikimedia.org/r/1259891

gerritbot added a project: Patch-For-Review.Mar 24 2026, 10:05 AM

mszwarc reopened this task as In Progress.Mar 24 2026, 10:06 AM

mszwarc edited projects, added: Product Safety and Integrity (Sprint Forsythia (Mar 23 - Apr 10))); removed: Product Safety and Integrity (Sprint Crocus (Mar 2 - Mar 20)).

mszwarc moved this task from Backlog to Needs review on the Product Safety and Integrity (Sprint Forsythia (Mar 23 - Apr 10))) board.

Change #1259891 merged by jenkins-bot: