Bug 33253

Summary: 2FA - Form not excluded from autofill
Product: Koha Reporter: Sam S <tech.sam>
Component: Staff interfaceAssignee: Katrin Fischer <katrin.fischer>
Status: RESOLVED FIXED QA Contact: Testopia <testopia>
Severity: minor    
Priority: P5 - low CC: gmcharlt, lucas
Version: Main   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: Trivial patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
23.05.00,22.11.06
Bug Depends on: 20476    
Bug Blocks:    
Attachments: Bug 33253: Turn off autocompletion for 2FA authentication code
Bug 33253: Turn off autocompletion for 2FA authentication code
Bug 33253: Turn off autocompletion for 2FA authentication code

Description Sam S 2023-03-16 16:52:28 UTC
I've been testing the 2FA module in our install, working great so far, but I noticed the authentication form field is not marked to be excluded from auto completion. Because of this, after several weeks of use, every time I click on the field, I see a list of all prior authentication codes used. This might be possible to be used in an attack to reverse-engineer the secret key using past codes and when they were entered. Even if that isn't the case, it means browsers are saving loads of unnecessary data that is one-time use. 

Information on how to disable auto completion in form fields can be found here:
https://developer.mozilla.org/en-US/docs/Web/Security/Securing_your_site/Turning_off_form_autocompletion
Comment 1 Katrin Fischer 2023-04-16 10:49:27 UTC
Created attachment 149725 [details] [review]
Bug 33253: Turn off autocompletion for 2FA authentication code

The form for entering your authentication code shoudl not suggest
previous codes.

To test:
* Activate TwoFactorAuthentication
* Go to your patron account in staff
* More > Manage 2-factor authentication
* I used "Google authenticator" on my phone, so:
* Open app on your phone, add new and scan the QR code
* Enter activation code
* Log out of staff interface
* Log back in, you are now also asked for an authentication code
  as second step
* Look up code in app, enter, get logged in
* Log out, log back in - the form now suggests the previous code
  when you click on it
* Apply patch
* Reload things (restart_all on ktd)
* Verify that you no longer get the suggestion
Comment 2 Katrin Fischer 2023-04-16 10:54:31 UTC
Thx for filing Sam! Maybe you want to test? It should work on the sandboxes too: 
https://wiki.koha-community.org/wiki/Sandboxes
Comment 3 David Nind 2023-04-16 19:57:29 UTC
Created attachment 149733 [details] [review]
Bug 33253: Turn off autocompletion for 2FA authentication code

The form for entering your authentication code shoudl not suggest
previous codes.

To test:
* Activate TwoFactorAuthentication
* Go to your patron account in staff
* More > Manage 2-factor authentication
* I used "Google authenticator" on my phone, so:
* Open app on your phone, add new and scan the QR code
* Enter activation code
* Log out of staff interface
* Log back in, you are now also asked for an authentication code
  as second step
* Look up code in app, enter, get logged in
* Log out, log back in - the form now suggests the previous code
  when you click on it
* Apply patch
* Reload things (restart_all on ktd)
* Verify that you no longer get the suggestion

Signed-off-by: David Nind <david@davidnind.com>
Comment 4 Jonathan Druart 2023-04-25 14:36:14 UTC
Created attachment 150210 [details] [review]
Bug 33253: Turn off autocompletion for 2FA authentication code

The form for entering your authentication code shoudl not suggest
previous codes.

To test:
* Activate TwoFactorAuthentication
* Go to your patron account in staff
* More > Manage 2-factor authentication
* I used "Google authenticator" on my phone, so:
* Open app on your phone, add new and scan the QR code
* Enter activation code
* Log out of staff interface
* Log back in, you are now also asked for an authentication code
  as second step
* Look up code in app, enter, get logged in
* Log out, log back in - the form now suggests the previous code
  when you click on it
* Apply patch
* Reload things (restart_all on ktd)
* Verify that you no longer get the suggestion

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 5 Tomás Cohen Arazi 2023-05-09 14:48:04 UTC
Pushed to master for 23.05.

Nice work everyone, thanks!
Comment 6 Matt Blenkinsop 2023-05-15 12:21:22 UTC
Nice work everyone!

Pushed to stable for 22.11.x