search

WordPress / wporg-two-factor

2FA for WordPress.org accounts
37 stars 8 forks source link

Redirect to backup codes for webauthn if none setup. #305

Closed StevenDufresne closed 3 months ago

StevenDufresne commented 3 months ago

Fixes: #253

This PR hooks into the <WebAuthn> onKeyAdd function added in #297 to redirect users to <BackupCodes> if they don't have backup codes installed yet.

dd32 commented 3 months ago

I'm not a super-fan of automatically redirecting after adding a key, even for TOTP it seems a bit weird.. but I get it, it's the only way at present to remind them to setup recovery codes..

I question whether this would be needed if something like #291 was implemented which triggered the #297 onboarding?

StevenDufresne commented 3 months ago

I question whether this would be needed if something like https://github.com/WordPress/wporg-two-factor/issues/291 was implemented which triggered the https://github.com/WordPress/wporg-two-factor/pull/297 onboarding?

I think those are fair points. I don't have a timeline for #291. However, I believe the current approach is a reasonable fallback. Since users cannot disable 2FA codes, adding a key without codes shouldn't lead to any awkward scenarios. Anyone who adds a key without codes will not have previously had them enabled.