nhyatt/bitwarden
1
0
Fork 0
mirror of https://github.com/bitwarden/server.git synced 2025-07-01 16:12:49 -05:00
Code Activity

[PM-21281] Email TOTP sent twice when user only has Email MFA enabled (#5782)

Browse Source 
* fix: addressed bug where email token is sent twice,

* test: updating tests to have correct DI and removing test for automatic email of TOTP.
This commit is contained in:
Ike
2025-05-09 12:13:01 -04:00
committed by GitHub
parent 3f95513d11
commit ead5bbdd2a
3 changed files with 11 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
src/Identity/IdentityServer/RequestValidators/TwoFactorAuthenticationValidator.cs
View File

@ -91,7 +91,10 @@ public class TwoFactorAuthenticationValidator(
{ "TwoFactorProviders2", providers },
};
// If we have email as a 2FA provider, we might need an SsoEmail2fa Session Token
// If we have an Email 2FA provider we need this session token so SSO users
// can re-request an email TOTP. The TwoFactorController.SendEmailLoginAsync
// endpoint requires a way to authenticate the user before sending another email with
// a TOTP, this token acts as the authentication mechanism.
if (enabledProviders.Any(p => p.Key == TwoFactorProviderType.Email))
{
twoFactorResultDict.Add("SsoEmail2faSessionToken",
@ -100,12 +103,6 @@ public class TwoFactorAuthenticationValidator(
twoFactorResultDict.Add("Email", user.Email);
}
if (enabledProviders.Count == 1 && enabledProviders.First().Key == TwoFactorProviderType.Email)
{
// Send email now if this is their only 2FA method
await _userService.SendTwoFactorEmailAsync(user);
}
return twoFactorResultDict;
}