Open jeffpaul opened 1 year ago
I extended the Two_Factor_Provider
class adding the function to log the failure:
And added it to TOTP:
Now, other providers can use it.
I guess it's not the better way to use error_log
, though.
Related: #476 would be a good follow-up to this IMO
Logging a placeholder issue from insight shared from @georgestephanis after finding a related tweet on this topic... We should fire off a log or alert to site admins on any failed 2FA code. Or an error_log or something. So if someone has a password but is trying to brute force a code it can get caught.