gravitee-io / issues

Gravitee.io - API Platform - Issues
65 stars 26 forks source link

MFA Challenge should be skipped if the user is strongly auth #10174

Open exalate-issue-sync[bot] opened 4 days ago

exalate-issue-sync[bot] commented 4 days ago

Describe the bug :

describe-the-bug-

Once the user is authenticated and redirected to the App. If the User goes back to the MFA Challenge using back button provided by the browser, he may receives the same code again according to the factor type (email for example, so the email is received twice)

When a user finalize the authentication flow, a request on login/mfa challenge or any other intermediary step should skip and the user should be redirected to the app.

To Reproduce :

to-reproduce-

Steps to reproduce the behaviour:

  1. Login
  2. MFA Challenge
  3. Token created
  4. User redirected to the application
  5. User hits backward of the browser
  6. User goes back to the MFA Challenge and receives the same code again

Desktop :

desktop-

Environment: 4.4.5