Skip to content

Remove TOTP requirement for WebAuthn

Aboobacker MK requested to merge remove-totp-req-webauthn-backend into master

What does this MR do and why?

Related to #378844 (closed)

This is the first set of backend changes for #378844 (closed). This MR removes the requirement that Time-based OTP needs to be enabled for Webauthn to work.

Screenshots or screen recordings

This MR is purely backend changes, there won't be any visible changes for the end user

How to set up and validate locally

To test the controller with the webauthn_without_totp enable:

  1. In rails console, run: Feature.enable(:webauthn_without_totp)
  2. Apply the frontend MR: curl https://gitlab.com/gitlab-org/gitlab/-/merge_requests/111659.diff | git apply
  3. Register webauthn device
  4. Save backup codes and click on "Proceed" button
  5. Webauthn registration success message should be shown on page
  6. Visiting https://gdk.test:3443/-/profile/two_factor_auth should show your registered Webauthn device
  7. Sign out of GitLab and back in, Webauthn validation should be required in login flow and allow you to complete login.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Eduardo Sanz García

Merge request reports