Bug 33253 - 2FA - Form not excluded from autofill
Summary: 2FA - Form not excluded from autofill
Status: RESOLVED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Staff interface (show other bugs)
Version: master
Hardware: All All
: P5 - low minor (vote)
Assignee: Katrin Fischer
QA Contact: Testopia
URL:
Keywords:
Depends on: 20476
Blocks:
  Show dependency treegraph
 
Reported: 2023-03-16 16:52 UTC by Sam S
Modified: 2023-06-15 18:58 UTC (History)
2 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
23.05.00,22.11.06


Attachments
Bug 33253: Turn off autocompletion for 2FA authentication code (1.74 KB, patch)
2023-04-16 10:49 UTC, Katrin Fischer
Details | Diff | Splinter Review
Bug 33253: Turn off autocompletion for 2FA authentication code (1.79 KB, patch)
2023-04-16 19:57 UTC, David Nind
Details | Diff | Splinter Review
Bug 33253: Turn off autocompletion for 2FA authentication code (1.86 KB, patch)
2023-04-25 14:36 UTC, Jonathan Druart
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Sam S 2023-03-16 16:52:28 UTC
I've been testing the 2FA module in our install, working great so far, but I noticed the authentication form field is not marked to be excluded from auto completion. Because of this, after several weeks of use, every time I click on the field, I see a list of all prior authentication codes used. This might be possible to be used in an attack to reverse-engineer the secret key using past codes and when they were entered. Even if that isn't the case, it means browsers are saving loads of unnecessary data that is one-time use. 

Information on how to disable auto completion in form fields can be found here:
https://developer.mozilla.org/en-US/docs/Web/Security/Securing_your_site/Turning_off_form_autocompletion
Comment 1 Katrin Fischer 2023-04-16 10:49:27 UTC
Created attachment 149725 [details] [review]
Bug 33253: Turn off autocompletion for 2FA authentication code

The form for entering your authentication code shoudl not suggest
previous codes.

To test:
* Activate TwoFactorAuthentication
* Go to your patron account in staff
* More > Manage 2-factor authentication
* I used "Google authenticator" on my phone, so:
* Open app on your phone, add new and scan the QR code
* Enter activation code
* Log out of staff interface
* Log back in, you are now also asked for an authentication code
  as second step
* Look up code in app, enter, get logged in
* Log out, log back in - the form now suggests the previous code
  when you click on it
* Apply patch
* Reload things (restart_all on ktd)
* Verify that you no longer get the suggestion
Comment 2 Katrin Fischer 2023-04-16 10:54:31 UTC
Thx for filing Sam! Maybe you want to test? It should work on the sandboxes too: 
https://wiki.koha-community.org/wiki/Sandboxes
Comment 3 David Nind 2023-04-16 19:57:29 UTC
Created attachment 149733 [details] [review]
Bug 33253: Turn off autocompletion for 2FA authentication code

The form for entering your authentication code shoudl not suggest
previous codes.

To test:
* Activate TwoFactorAuthentication
* Go to your patron account in staff
* More > Manage 2-factor authentication
* I used "Google authenticator" on my phone, so:
* Open app on your phone, add new and scan the QR code
* Enter activation code
* Log out of staff interface
* Log back in, you are now also asked for an authentication code
  as second step
* Look up code in app, enter, get logged in
* Log out, log back in - the form now suggests the previous code
  when you click on it
* Apply patch
* Reload things (restart_all on ktd)
* Verify that you no longer get the suggestion

Signed-off-by: David Nind <david@davidnind.com>
Comment 4 Jonathan Druart 2023-04-25 14:36:14 UTC
Created attachment 150210 [details] [review]
Bug 33253: Turn off autocompletion for 2FA authentication code

The form for entering your authentication code shoudl not suggest
previous codes.

To test:
* Activate TwoFactorAuthentication
* Go to your patron account in staff
* More > Manage 2-factor authentication
* I used "Google authenticator" on my phone, so:
* Open app on your phone, add new and scan the QR code
* Enter activation code
* Log out of staff interface
* Log back in, you are now also asked for an authentication code
  as second step
* Look up code in app, enter, get logged in
* Log out, log back in - the form now suggests the previous code
  when you click on it
* Apply patch
* Reload things (restart_all on ktd)
* Verify that you no longer get the suggestion

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 5 Tomás Cohen Arazi 2023-05-09 14:48:04 UTC
Pushed to master for 23.05.

Nice work everyone, thanks!
Comment 6 Matt Blenkinsop 2023-05-15 12:21:22 UTC
Nice work everyone!

Pushed to stable for 22.11.x