Require email confirmation for TOTP-based logins #18689
Conversation
miketheman
left a comment
miketheman
left a comment
There was a problem hiding this comment.
Lots of comments inline. Let me know if they need further details.
Aside: I wonder if there's an opportunity to use these kinds of "annoying" interactions to push webauthn more, but I still want that to be a smoother experience.
miketheman
left a comment
miketheman
left a comment
There was a problem hiding this comment.
Other than the migration needing a rebase, I think this looks good to me - I'd prefer if at least one other admin reviews as well.
warehouse/migrations/versions/4c20f2342bba_add_useruniquelogin.py
Outdated
Show resolved
Hide resolved
warehouse/migrations/versions/4c20f2342bba_add_useruniquelogin.py
Outdated
Show resolved
Hide resolved
ewdurbin
left a comment
ewdurbin
left a comment
There was a problem hiding this comment.
Some notes on verbiage.
Overall I think this is great to get shipped and see how the UX goes... My only concern is that we don't tell users how to avoid this dance up-front. Should we be clear with them what tripped the confirmation email and suggest that they consider using a better 2FA method?
| </tr> | ||
| </thead> | ||
| <tbody> | ||
| {% for login in user.unique_logins %} |
There was a problem hiding this comment.
we are almost certainlty going to need to paginate this... but for now seems fine since its admin.
3 participants
Fixes #18425.
This PR maintains a record of device information across logins for each user: