Commit graph

6 commits

Author SHA1 Message Date
Sean McGivern
194fbc3c3d Restrict failed login attempts for users with 2FA
Copy logic from `Devise::Models::Lockable#valid_for_authentication?`, as
our custom login flow with two pages doesn't call this method. This will
increment the failed login counter, and lock the user's account once
they exceed the number of failed attempts.

Also ensure that users who are locked can't continue to submit 2FA
codes.
2016-10-04 15:01:38 +01:00
DJ Mountney
9224f031cf Pass the remember_me option into the u2f form and support it while authenticating
Matches the changes done for non-u2f two-factor auth
2016-09-01 17:11:42 -07:00
Timothy Andrew
3572582dd2 Use a single challenge for U2F authentication.
1. According to the spec, either we have a single challenge with
   a number of `signRequests`, or a number of `signRequests`, each with
   it's own challenge.

2. Previously, we had both these - per-request challenges, as well as a
   single extra challenge.

3. This commit changes this so that the per-request challenges are
   removed, leaving only a single challenge, as per the v1.1 U2F API.

4. The existing implementation didn't work in Firefox, because the
   Firefox (extension) implementation is less flexible with regard to
   the inputs.

5. Fix teaspoon specs.

6. References: https://fidoalliance.org/specs/fido-u2f-v1.0-nfc-bt-amendment-20150514/fido-u2f-javascript-api.html#h2_background
2016-07-14 08:19:09 +05:30
Timothy Andrew
4b33c4c6d1 Load Javascript U2F library selectively.
1. Only on supported Chrome versions

2. Mainly, this lets us simplify the javascript-based U2F check to
   `window.u2f`, where `window.u2f` can either be loaded from the GitLab
   server (for Chrome) or from the Firefox extension.

3. This is a better way to provide browser detection for U2F.
2016-07-14 08:19:09 +05:30
Timothy Andrew
86b07caa59 Implement authentication (login) using a U2F device.
- Move the `authenticate_with_two_factor` method from
  `ApplicationController` to the `AuthenticatesWithTwoFactor` module,
  where it should be.
2016-06-06 12:50:31 +05:30
Robert Speicher
c802d8eee1 Refactor SessionsController to use a controller concern 2015-05-14 14:24:05 -04:00