diff --git a/CHANGELOG.md b/CHANGELOG.md index 3028b2e..a758b04 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,11 @@ ## 2.6.0 (dev) * Adding Backup Recovery Codes (Recovery) as a method. Thanks to @Spitfireap for work, and @peterthomassen for guidance. + * Added: `RECOVERY_ITERATION` to set the number of iteration when hashing recovery token + * Added: `MFA_ENFORCE_RECOVERY_METHOD` to enforce the user to enroll in the recovery code method once, they add any other method, + * Added: `MFA_ALWAYS_GO_TO_LAST_METHOD` to the settings which redirects the user automatically to the last used method when logging in + * Added: `MFA_RENAME_METHODS` to be able to rename the methods for the user. + * Fix: Alot of CSS fixes for the example application ## 2.5.0 diff --git a/README.md b/README.md index b2ac4c3..e113f1e 100644 --- a/README.md +++ b/README.md @@ -76,6 +76,8 @@ Depends on MFA_RECHECK_MIN=10 # Minimum interval in seconds MFA_RECHECK_MAX=30 # Maximum in seconds MFA_QUICKLOGIN=True # Allow quick login for returning users by provide only their 2FA + MFA_ALWAYS_GO_TO_LAST_METHOD = False # Always redirect the user to the last method used to save a click (Added in 2.6.0). + MFA_RENAME_METHODS={} #Rename the methods in a more user-friendly way e.g {"RECOVERY":"Backup Codes"} (Added in 2.6.0) MFA_HIDE_DISABLE=('FIDO2',) # Can the user disable his key (Added in 1.2.0). MFA_OWNED_BY_ENTERPRISE = FALSE # Who owns security keys PASSWORD_HASHERS = DEFAULT_PASSWORD_HASHERS #Comment if PASSWORD_HASHER already set @@ -102,6 +104,8 @@ Depends on * Starting version 1.7.0, Key owners can be specified. * Starting version 2.2.0 * Added: `MFA_SUCCESS_REGISTRATION_MSG` & `MFA_REDIRECT_AFTER_REGISTRATION` + Start version 2.6.0 + * Added: `MFA_ALWAYS_GO_TO_LAST_METHOD`, & `MFA_RENAME_METHODS` 4. Break your login function Usually your login function will check for username and password, log the user in if the username and password are correct and create the user session, to support mfa, this has to change diff --git a/example/example/settings.py b/example/example/settings.py index b55196d..a341a6c 100644 --- a/example/example/settings.py +++ b/example/example/settings.py @@ -143,11 +143,14 @@ MFA_QUICKLOGIN=True # Allow quick login for returning users by provide on MFA_HIDE_DISABLE=('',) # Can the user disable his key (Added in 1.2.0). MFA_REDIRECT_AFTER_REGISTRATION="registered" MFA_SUCCESS_REGISTRATION_MSG="Go to Home" +MFA_ALWAYS_GO_TO_LAST_METHOD = True +MFA_ENFORCE_RECOVERY_METHOD = True +MFA_RENAME_METHODS = {"RECOVERY":"Backup Codes","FIDO2":"Biometric Authentication"} PASSWORD_HASHERS = DEFAULT_PASSWORD_HASHERS #Comment if PASSWORD_HASHER already set PASSWORD_HASHERS += ['mfa.recovery.Hash'] RECOVERY_ITERATION = 1 #Number of iteration for recovery code, higher is more secure, but uses more resources for generation and check... TOKEN_ISSUER_NAME="PROJECT_NAME" #TOTP Issuer name -U2F_APPID="https://localhost" #URL For U2F +U2F_APPID="https://localhost:9000" #URL For U2F FIDO_SERVER_ID="localhost" # Server rp id for FIDO2, it the full domain of your project FIDO_SERVER_NAME="TestApp" diff --git a/example/example/templates/base.html b/example/example/templates/base.html index e5b1a6e..be5fdb6 100644 --- a/example/example/templates/base.html +++ b/example/example/templates/base.html @@ -10,7 +10,7 @@ -
You still have "+tokenLeft+" backup code left." + html += "
You still have "+tokenLeft+" backup code left." } document.getElementById('tokens').innerHTML = html }}) diff --git a/mfa/templates/TOTP/Add.html b/mfa/templates/TOTP/Add.html index 7bd2ce6..a7aebaa 100644 --- a/mfa/templates/TOTP/Add.html +++ b/mfa/templates/TOTP/Add.html @@ -38,13 +38,16 @@ $.ajax({ "url":"{% url 'verify_otop' %}?key="+key+ "&answer="+answer, success:function (data) { - if (data == "Error") - alert("You entered wrong numbers, please try again") - else - { - alert("Your authenticator is added successfully.") - window.location.href="{{ redirect_html }}" - } + if (data =='Success') + $("#res").html("
Scan the image below with the two-factor authentication app on your phone/PC. If you can’t use a barcode, enter this text instead.
Enter the six-digit code from the application
@@ -88,16 +94,13 @@Your secure Key should be flashing now, please press on button.
diff --git a/mfa/templates/U2F/recheck.html b/mfa/templates/U2F/recheck.html index 5f47b44..a908ae8 100644 --- a/mfa/templates/U2F/recheck.html +++ b/mfa/templates/U2F/recheck.html @@ -4,7 +4,7 @@