search

jazzband / django-two-factor-auth

Complete Two-Factor Authentication for Django providing the easiest integration into most Django projects.
MIT License
1.7k stars 447 forks source link

user.is_verified() returns False with subdomains #518

Open adnanrafique opened 2 years ago

adnanrafique commented 2 years ago

I am using django-two-factor-auth in my Django application, Everything works fine in the local environment.

My application is tenant-based and I am using subdomains for each tenant, for example,

my application => xyz.com

user with tenant name "a" after login gets redirected to => a.xyz.com user with tenant name "b" after login gets redirected to => b.xyz.com

When redirected to a subdomain I am getting this issue that user.is_verified() always returns False even if 2fa is enabled for user.

If I remove the subdomain redirection, it works fine and returns True if 2fa is enabled for a user.

Expected Behavior

It should return True for the users who have enabled 2fa.

Current Behavior

It always returns False even for the users who have enabled 2fa.

Your Environment

moggers87 commented 2 years ago

What's SESSION_COOKIE_DOMAIN set to? IIRC, Django's session cookies have HostOnly set on them so you'll need to make sure SESSION_COOKIE_DOMAIN has a value like .xyz.com (note the . at the start of the string) to make the session cookie work with the subdomains.