[Bug 43785] New: 2FA code fields should use autocomplete="one-time-code" so password managers can fill the TOTP code
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43785 Bug ID: 43785 Summary: 2FA code fields should use autocomplete="one-time-code" so password managers can fill the TOTP code Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Authentication Assignee: koha-bugs@lists.koha-community.org Reporter: mr.dugi@gmail.com QA Contact: martin.renvoize@openfifth.co.uk CC: dpavlin@rot13.org Target Milestone: --- The staff interface 2FA login field (otp_token in koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt) is a plain <input type="text"> inside a form with autocomplete="off" (added by Bug 33253). Password managers that store TOTP secrets (Apple Passwords on iOS/macOS, 1Password, Bitwarden...) only offer to fill a verification code when the field is marked autocomplete="one-time-code". As a result, staff who keep their Koha TOTP in such a manager have to switch apps and copy the code by hand, and on phones the field opens the full text keyboard instead of a numeric one. Bug 33253's concern still holds with this change: browsers do not store one-time-code values in form history, so it does not bring back suggestions of previous codes. The same applies to the PIN field on the 2FA setup page (pin_code in includes/auth-two-factor.inc, used by auth.tt when 2FA is enforced and by members/two_factor_auth.tt). To reproduce: 1. Set TwoFactorAuthentication to "Enabled" or "Enforced". 2. Enrol a staff account, saving the TOTP secret in Apple Passwords (or another manager that supports verification codes). 3. Log out, then log in to the staff interface with username and password in Safari on iOS or macOS. 4. On the "Two-factor authentication code" step, focus the field. Expected: the browser offers the current code from the password manager; on mobile a numeric keypad opens. Actual: no code is offered and the full text keyboard opens; the code has to be copied manually. Proposed fix: - auth.tt: add autocomplete="one-time-code" inputmode="numeric" autocapitalize="off" to the otp_token input (an element-level value overrides the form's autocomplete="off"; optionally drop autocomplete="off" from that form). - includes/auth-two-factor.inc: add the same attributes to the pin_code input. - Optionally pattern="[0-9]*". Test plan: 1. Apply the patch. 2. Enrol a staff account with Apple Passwords or 1Password; log out and log in again. 3. Confirm the code is offered and fills in, and login succeeds. 4. Confirm previous codes are not suggested from form history (Bug 33253 behaviour unchanged). Related: Bug 33253 (2FA form excluded from autofill), Bug 29487 (autocomplete off on login fields). -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43785 Ján Dugovič <mr.dugi@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |mr.dugi@gmail.com Assignee|koha-bugs@lists.koha-commun |mr.dugi@gmail.com |ity.org | Status|NEW |Needs Signoff --- Comment #1 from Ján Dugovič <mr.dugi@gmail.com> --- Created attachment 207806 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=207806&action=edit Bug 43785: Add autocomplete="one-time-code" to 2FA code fields -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43785 Frédéric Demians <f.demians@tamil.fr> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off Patch complexity|--- |String patch -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43785 Frédéric Demians <f.demians@tamil.fr> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #207806|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43785 --- Comment #2 from Frédéric Demians <f.demians@tamil.fr> --- Created attachment 207999 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=207999&action=edit Bug 43785: Add autocomplete="one-time-code" to 2FA code fields Password managers that store TOTP secrets (Apple Passwords, 1Password, Bitwarden) only offer a verification code for fields marked autocomplete="one-time-code". This marks the staff 2FA login field and the 2FA setup PIN field accordingly, and requests a numeric keypad on mobile. The element-level value overrides the form's autocomplete="off" (Bug 33253) and browsers do not keep one-time codes in form history. Test plan: 1. Set the TwoFactorAuthentication system preference to "Enabled". 2. Enrol a staff user in 2FA, saving the TOTP secret in Apple Passwords or 1Password. 3. Log out, then log in with username and password in Safari (macOS or iOS). 4. On the two-factor authentication step, focus the code field: no code is offered and a full text keyboard opens on mobile. 5. Apply the patch, restart_all, and repeat steps 3-4. 6. Confirm the current code is offered by the password manager and a numeric keypad opens on mobile. 7. Confirm the code fills in and login succeeds. 8. Confirm previously entered codes are not suggested from browser form history (Bug 33253 behaviour unchanged). 9. Set TwoFactorAuthentication to "Enforced" (or go to a patron's "Manage two-factor authentication" page) and confirm the PIN field on the setup page behaves the same way. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Signed-off-by: Frédéric Demians <f.demians@tamil.fr> I can confirm it works -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43785 --- Comment #3 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- QA: Scripts are happy, code reviewed. Reviewed the patch (1 commit, 2 template files): - Both 2FA code inputs are covered: the staff login field (otp_token, auth.tt) and the setup PIN field (pin_code, auth-two-factor.inc). No other 2FA code input exists in koha-tmpl (OPAC has none). - The field-level autocomplete="one-time-code" overrides the form-level autocomplete="off" from Bug 33253; the username and password fields keep autocomplete="off", so that behaviour is unchanged. - inputmode="numeric" is appropriate for TOTP PINs and only affects the mobile keyboard; the input remains type="text". - No escaping, CSRF or permission changes; no security impact. - Commit message is clear, subject correctly prefixed, test plan thorough. No regressions found. Passing QA. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43785 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA Patch complexity|String patch |Trivial patch -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43785 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #207999|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43785 --- Comment #4 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 208455 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=208455&action=edit Bug 43785: Add autocomplete="one-time-code" to 2FA code fields Password managers that store TOTP secrets (Apple Passwords, 1Password, Bitwarden) only offer a verification code for fields marked autocomplete="one-time-code". This marks the staff 2FA login field and the 2FA setup PIN field accordingly, and requests a numeric keypad on mobile. The element-level value overrides the form's autocomplete="off" (Bug 33253) and browsers do not keep one-time codes in form history. Test plan: 1. Set the TwoFactorAuthentication system preference to "Enabled". 2. Enrol a staff user in 2FA, saving the TOTP secret in Apple Passwords or 1Password. 3. Log out, then log in with username and password in Safari (macOS or iOS). 4. On the two-factor authentication step, focus the code field: no code is offered and a full text keyboard opens on mobile. 5. Apply the patch, restart_all, and repeat steps 3-4. 6. Confirm the current code is offered by the password manager and a numeric keypad opens on mobile. 7. Confirm the code fills in and login succeeds. 8. Confirm previously entered codes are not suggested from browser form history (Bug 33253 behaviour unchanged). 9. Set TwoFactorAuthentication to "Enforced" (or go to a patron's "Manage two-factor authentication" page) and confirm the PIN field on the setup page behaves the same way. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Signed-off-by: Frédéric Demians <f.demians@tamil.fr> Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43785 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |33253 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33253 [Bug 33253] 2FA - Form not excluded from autofill -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43785 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on|33253 | CC| |dcook@prosentient.com.au Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33253 [Bug 33253] 2FA - Form not excluded from autofill -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43785 --- Comment #5 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Any security concerns here David Cook? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43785 --- Comment #6 from David Cook <dcook@prosentient.com.au> --- (In reply to Martin Renvoize (ashimema) from comment #5)
Any security concerns here David Cook?
Nope, sounds great to me. In fact, I think a use case not mentioned here is how on mobile devices the autocomplete via an SMS or email becomes possible as well, which is a super convenient feature when you're using SMS or email with OTPs. We could probably benefit from using some autocompletes in other places... -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43785 Pedro Amorim (ammopt) <pedro.amorim@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)| |26.11.00 released in| | Status|Passed QA |Pushed to main -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43785 --- Comment #7 from Pedro Amorim (ammopt) <pedro.amorim@openfifth.co.uk> --- Thanks everyone! Pushed to main for 26.11! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43785 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to main |Needs documenting CC| |lucas@bywatersolutions.com --- Comment #8 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- No 26.05.x backport -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org