Prevent 2FA token regeneration in the same session
What does this MR do?
As seen in #247461 (closed), we have resources through the UploadsController that, when 2FA is enforced, will also get redirected to this page, effectively re-generating the secret after the QR and key were generated and shown to the user. This effectively led to permanently invalid pin codes for some users.
This MR is an alternative fix to !42784 (merged) and saves the state of the token generation in the session, so it won't be re-generated in the same session.
/cc @dblessing
Screenshots
Does this MR meet the acceptance criteria?
Conformity
-
Changelog entry -
Documentation (if required) -
Code review guidelines -
Merge request performance guidelines -
Style guides -
Database guides -
Separation of EE specific content
Availability and Testing
-
Review and add/update tests for this feature/bug. Consider all test levels. See the Test Planning Process. -
Tested in all supported browsers -
Informed Infrastructure department of a default or new setting change, if applicable per definition of done
Security
If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:
-
Label as security and @ mention @gitlab-com/gl-security/appsec -
The MR includes necessary changes to maintain consistency between UI, API, email, or other methods -
Security reports checked/validated by a reviewer from the AppSec team