Skip to content

Two factor authentication support#630

Merged
lunny merged 11 commits intogo-gitea:masterfrom
minecrafter:2fa
Jan 16, 2017
Merged

Two factor authentication support#630
lunny merged 11 commits intogo-gitea:masterfrom
minecrafter:2fa

Conversation

@minecrafter
Copy link
Copy Markdown
Contributor

@minecrafter minecrafter commented Jan 10, 2017 •
edited
Loading

This PR is still a work in progress and therefore I do not recommend pulling this just yet.

This adds two-factor authentication support to Gitea, resolving #179. As I'm new to Gitea and fairly new to Go, I'm looking for friendly input.

There are a few issues that need to be looked at:

  • Hashing the scratch code: at the moment, scratch codes are unhashed. This may be fine as you'd need to break the password first, which is relatively difficult, but another layer of security would not hurt.

@minecrafter
Initial commit for 2FA support
d810cc4 
Signed-off-by: Andrew <write@imaginarycode.com>
@lunny lunny added this to the 1.1.0 milestone Jan 10, 2017
@lunny lunny added type/feature Completely new functionality. Can only be merged if feature freeze is not active. topic/security Something leaks user information or is otherwise vulnerable. Should be fixed! pr/wip This PR is not ready for review labels Jan 10, 2017
@metalmatze
Copy link
Copy Markdown
Contributor

metalmatze commented Jan 10, 2017

Looking good so far. I'll fetch and checkout this branch later. Merging this will be awesome!

@tboerger tboerger added the lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. label Jan 10, 2017
@lunny
Copy link
Copy Markdown
Member

lunny commented Jan 10, 2017

@minecrafter Is this ready for review? not WIP?

BlackVoid
BlackVoid reviewed Jan 10, 2017
View reviewed changes
cmd/web.go Outdated
m.Get("/2fa", user.ShowTwofa)
m.Post("/2fa", bindIgnErr(auth.TwofaAuthForm{}), user.TwofaPost)
m.Get("/2fa_scratch", user.TwofaScratch)
m.Post("/2fa_scratch", bindIgnErr(auth.TwofaScratchAuthForm{}), user.TwofaScratchPost)
Copy link
Copy Markdown

@BlackVoid BlackVoid Jan 10, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since there are many endpoints it might be better to use the following structure and change 2fa_scratch to be 2fa/scratch.

m.Group("/2fa", func() {
    m.Get("", user.ShowTwofa)
    [...]
})

cmd/web.go Outdated
m.Post("/2fa/regenerate_scratch", user.SettingsTwofaRegenerateScratch)
m.Post("/2fa/disable", user.SettingsTwofaDisable)
m.Get("/2fa/enroll", user.SettingsTwofaEnroll)
m.Post("/2fa/enroll", bindIgnErr(auth.TwofaAuthForm{}), user.SettingsTwofaEnrollPost)
Copy link
Copy Markdown

@BlackVoid BlackVoid Jan 10, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same here

@minecrafter
Copy link
Copy Markdown
Contributor Author

minecrafter commented Jan 10, 2017

@lunny It's a WIP still. I will probably finish it up this week.

@minecrafter
Copy link
Copy Markdown
Contributor Author

minecrafter commented Jan 13, 2017

Have some time to work on this - going to be improving the code and finalizing everything.

@minecrafter
Copy link
Copy Markdown
Contributor Author

minecrafter commented Jan 14, 2017

Ready to get this pull request reviewed.

@lunny lunny removed the pr/wip This PR is not ready for review label Jan 15, 2017
@lunny
Copy link
Copy Markdown
Member

lunny commented Jan 15, 2017

LGTM, Good Job!

@tboerger tboerger added lgtm/need 1 This PR needs approval from one additional maintainer to be merged. and removed lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. labels Jan 15, 2017
Bwko
Bwko reviewed Jan 15, 2017
View reviewed changes
routers/user/auth.go Outdated

handleSignInFull(ctx, u, remember, false)
ctx.Flash.Info(ctx.Tr("auth.twofa_scratch_used"))
ctx.Redirect(setting.AppSubURL + "/user/settings/twofa")
Copy link
Copy Markdown
Member

@Bwko Bwko Jan 15, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should be 2fa instead of twofa

Copy link
Copy Markdown
Member

@lunny lunny Jan 15, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

^

Copy link
Copy Markdown
Contributor Author

@minecrafter minecrafter Jan 15, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed

@bkcsoft
Copy link
Copy Markdown
Contributor

bkcsoft commented Jan 15, 2017 •
edited
Loading

I would prefer if you changed "twofa" to "twofactor" instead, it makes it easier to read since we can't do "2fa" or "TwoFA" :)

@metalmatze
Copy link
Copy Markdown
Contributor

metalmatze commented Jan 16, 2017

Just tried it locally and it seems to be working just fine.
LGTM

@tboerger tboerger added lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. and removed lgtm/need 1 This PR needs approval from one additional maintainer to be merged. labels Jan 16, 2017
@minecrafter
Copy link
Copy Markdown
Contributor Author

minecrafter commented Jan 16, 2017

Thanks! 👍

@bkcsoft I might consider doing so, but otherwise it works well so it's more of a cosmetic issue.

@lunny
Copy link
Copy Markdown
Member

lunny commented Jan 16, 2017

@minecrafter can't wait to merge it. When would you like to push a commit for @bkcsoft's advice?

lunny
lunny requested changes Jan 16, 2017
View reviewed changes
Copy link
Copy Markdown
Member

@lunny lunny left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

otherwise LGTM

models/twofactor.go Outdated
// TwoFactor represents a two-factor authentication token.
type TwoFactor struct {
ID int64 `xorm:"pk autoincr"`
UID int64 `xorm:"UNIQUE INDEX"`
Copy link
Copy Markdown
Member

@lunny lunny Jan 16, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's no need for both UNIQUE and INDEX, chose one.

Copy link
Copy Markdown
Contributor Author

@minecrafter minecrafter Jan 16, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed

@lunny
Copy link
Copy Markdown
Member

lunny commented Jan 16, 2017

Let L-G-T-M work

@lunny lunny merged commit 6dd096b into go-gitea:master Jan 16, 2017
@lunny
Copy link
Copy Markdown
Member

lunny commented Jan 16, 2017

Thanks!

@minecrafter
Copy link
Copy Markdown
Contributor Author

minecrafter commented Jan 16, 2017

No problem! 😄

@go-gitea go-gitea locked and limited conversation to collaborators Nov 23, 2020
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@lunny lunny lunny approved these changes

+2 more reviewers

@BlackVoid BlackVoid BlackVoid left review comments

@Bwko Bwko Bwko left review comments

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. topic/security Something leaks user information or is otherwise vulnerable. Should be fixed! type/feature Completely new functionality. Can only be merged if feature freeze is not active.

Projects

None yet

Milestone

1.1.0

Development

Successfully merging this pull request may close these issues.

7 participants

@minecrafter @metalmatze @lunny @bkcsoft @BlackVoid @Bwko @tboerger