https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43785
Bug ID: 43785
Summary: 2FA code fields should use
autocomplete="one-time-code" so password managers can
fill the TOTP code
Initiative type: ---
Sponsorship ---
status:
Product: Koha
Version: Main
Hardware: All
OS: All
Status: NEW
Severity: enhancement
Priority: P5 - low
Component: Authentication
Assignee: [email protected]
Reporter: [email protected]
QA Contact: [email protected]
CC: [email protected]
Target Milestone: ---
The staff interface 2FA login field (otp_token in
koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt) is a plain <input type="text">
inside a form with autocomplete="off" (added by Bug 33253). Password managers
that store TOTP secrets (Apple Passwords on iOS/macOS, 1Password, Bitwarden...)
only offer to fill a verification code when the field is marked
autocomplete="one-time-code". As a result, staff who keep their Koha TOTP in
such a manager have to switch apps and copy the code by hand, and on phones the
field opens the full text keyboard instead of a numeric one.
Bug 33253's concern still holds with this change: browsers do not store
one-time-code values in form history, so it does not bring back suggestions of
previous codes.
The same applies to the PIN field on the 2FA setup page (pin_code in
includes/auth-two-factor.inc, used by auth.tt when 2FA is enforced and by
members/two_factor_auth.tt).
To reproduce:
1. Set TwoFactorAuthentication to "Enabled" or "Enforced".
2. Enrol a staff account, saving the TOTP secret in Apple Passwords (or another
manager that supports verification codes).
3. Log out, then log in to the staff interface with username and password in
Safari on iOS or macOS.
4. On the "Two-factor authentication code" step, focus the field.
Expected: the browser offers the current code from the password manager; on
mobile a numeric keypad opens.
Actual: no code is offered and the full text keyboard opens; the code has to be
copied manually.
Proposed fix:
- auth.tt: add autocomplete="one-time-code" inputmode="numeric"
autocapitalize="off" to the otp_token input (an element-level value overrides
the form's autocomplete="off"; optionally drop autocomplete="off" from that
form).
- includes/auth-two-factor.inc: add the same attributes to the pin_code input.
- Optionally pattern="[0-9]*".
Test plan:
1. Apply the patch.
2. Enrol a staff account with Apple Passwords or 1Password; log out and log in
again.
3. Confirm the code is offered and fills in, and login succeeds.
4. Confirm previous codes are not suggested from form history (Bug 33253
behaviour unchanged).
Related: Bug 33253 (2FA form excluded from autofill), Bug 29487 (autocomplete
off on login fields).
--
You are receiving this mail because:
You are the assignee for the bug.
You are watching all bug changes.
_______________________________________________
Koha-bugs mailing list -- [email protected]
To unsubscribe send an email to [email protected]
website : http://www.koha-community.org/
git : http://git.koha-community.org/
bugs : http://bugs.koha-community.org/
