https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43785 Bug ID: 43785 Summary: 2FA code fields should use autocomplete="one-time-code" so password managers can fill the TOTP code Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Authentication Assignee: koha-bugs@lists.koha-community.org Reporter: mr.dugi@gmail.com QA Contact: martin.renvoize@openfifth.co.uk CC: dpavlin@rot13.org Target Milestone: --- The staff interface 2FA login field (otp_token in koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt) is a plain <input type="text"> inside a form with autocomplete="off" (added by Bug 33253). Password managers that store TOTP secrets (Apple Passwords on iOS/macOS, 1Password, Bitwarden...) only offer to fill a verification code when the field is marked autocomplete="one-time-code". As a result, staff who keep their Koha TOTP in such a manager have to switch apps and copy the code by hand, and on phones the field opens the full text keyboard instead of a numeric one. Bug 33253's concern still holds with this change: browsers do not store one-time-code values in form history, so it does not bring back suggestions of previous codes. The same applies to the PIN field on the 2FA setup page (pin_code in includes/auth-two-factor.inc, used by auth.tt when 2FA is enforced and by members/two_factor_auth.tt). To reproduce: 1. Set TwoFactorAuthentication to "Enabled" or "Enforced". 2. Enrol a staff account, saving the TOTP secret in Apple Passwords (or another manager that supports verification codes). 3. Log out, then log in to the staff interface with username and password in Safari on iOS or macOS. 4. On the "Two-factor authentication code" step, focus the field. Expected: the browser offers the current code from the password manager; on mobile a numeric keypad opens. Actual: no code is offered and the full text keyboard opens; the code has to be copied manually. Proposed fix: - auth.tt: add autocomplete="one-time-code" inputmode="numeric" autocapitalize="off" to the otp_token input (an element-level value overrides the form's autocomplete="off"; optionally drop autocomplete="off" from that form). - includes/auth-two-factor.inc: add the same attributes to the pin_code input. - Optionally pattern="[0-9]*". Test plan: 1. Apply the patch. 2. Enrol a staff account with Apple Passwords or 1Password; log out and log in again. 3. Confirm the code is offered and fills in, and login succeeds. 4. Confirm previous codes are not suggested from form history (Bug 33253 behaviour unchanged). Related: Bug 33253 (2FA form excluded from autofill), Bug 29487 (autocomplete off on login fields). -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.