authentication-zero 2.16.17 → 2.16.19

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 54633f078d0da7d8832e1e8067b1a6462ddcf567351b5f15e548f62ab0307d86
-  data.tar.gz: ca024f87f0c49e1534679fedadc7d3944209be7c955a3bc46e254e3d4c790f73
+  metadata.gz: cde9e441220d034130e39d950ed95456464b09c239596df6b1a84743292d5501
+  data.tar.gz: df3da73d206c8a5b7d824afabf0c4b1882e61f8102e841a3cabaf6d6e366dac6
 SHA512:
-  metadata.gz: 2646e6b0e95f86ab931fa4338cf587894265078e346a3cb5a3b919bc3b5aba7a0eab9bb8a72e16dcce96efbec43764f4d47df08d6c2011d57994e958a6b295cc
-  data.tar.gz: 449db5cde90d0ba2bdbfc4df356c2eca24eab9464f88f149229b4cddaf63ce03cb1bcdf211af60af443db1a411ecfd800e98f871b6c717747da8863620ce33a7
+  metadata.gz: 2b8fa852a07b2d4714f3b37b4632d5b3c214f405d4ba45882b76a175a9d853859852f564229c1e1a0457ceb495d0cae4a7146bea2ab51c6265558d0a0cb87cc4
+  data.tar.gz: 1749b558ec810c4ec0c36505a030a62c3134c47619e5afeafc198afa3aabf4762719cf05465647be7960ff4a3f53950a6664a872df9407e59d9b0d4bf762ba50

data/CHANGELOG.md

@@ -1,3 +1,7 @@
+## Authentication Zero 2.16.18 ##
+
+* Use session to store the token for the 2fa challenge
+
 ## Authentication Zero 2.16.16 ##
 
 * Add recovery codes to two factor auth

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    authentication-zero (2.16.17)
+    authentication-zero (2.16.19)
 
 GEM
   remote: https://rubygems.org/

data/lib/authentication_zero/version.rb

@@ -1,3 +1,3 @@
 module AuthenticationZero
-  VERSION = "2.16.17"
+  VERSION = "2.16.19"
 end

data/lib/generators/authentication/templates/controllers/html/sessions_controller.rb.tt

@@ -17,8 +17,8 @@ class SessionsController < ApplicationController
     if user && user.authenticate(params[:password])
       <%- if two_factor? -%>
       if user.otp_secret.present?
-        signed_id = user.signed_id(purpose: :authentication_challenge, expires_in: 20.minutes)
-        redirect_to new_two_factor_authentication_challenge_path(token: signed_id)
+        session[:challenge_token] = user.signed_id(purpose: :authentication_challenge, expires_in: 20.minutes)
+        redirect_to new_two_factor_authentication_challenge_path
       else
         @session = user.sessions.create!
         cookies.signed.permanent[:session_token] = { value: @session.id, httponly: true }

data/lib/generators/authentication/templates/controllers/html/two_factor_authentication/challenges_controller.rb.tt

@@ -16,7 +16,7 @@ class TwoFactorAuthentication::ChallengesController < ApplicationController
 
   private
     def set_user
-      @user = User.find_signed!(params[:token], purpose: :authentication_challenge)
+      @user = User.find_signed!(session[:challenge_token], purpose: :authentication_challenge)
     rescue StandardError
       redirect_to sign_in_path, alert: "That's taking too long. Please re-enter your password and try again"
     end
@@ -47,6 +47,6 @@ class TwoFactorAuthentication::ChallengesController < ApplicationController
     end
 
     def redirect_to_authentication_challenge
-      redirect_to new_two_factor_authentication_challenge_path(token: params[:token], scheme_type: params[:scheme_type]), alert: "That code didn't work. Please try again"
+      redirect_to new_two_factor_authentication_challenge_path(scheme_type: params[:scheme_type]), alert: "That code didn't work. Please try again"
     end
 end

data/lib/generators/authentication/templates/controllers/html/two_factor_authentication/recovery_codes_controller.rb.tt

@@ -26,6 +26,6 @@ class TwoFactorAuthentication::RecoveryCodesController < ApplicationController
     end
 
     def new_recovery_code
-      SecureRandom.alphanumeric(10).insert(5, "-").downcase
+      SecureRandom.alphanumeric(10).downcase
     end
 end

data/lib/generators/authentication/templates/erb/two_factor_authentication/challenges/_recovery_code_form.html.erb.tt

@@ -1,5 +1,4 @@
 <%%= form_with(url: two_factor_authentication_challenge_path) do |form| %>
-  <%%= form.hidden_field :token, value: params[:token] %>
   <%%= form.hidden_field :scheme_type, value: "recovery_codes" %>
 
   <div>

data/lib/generators/authentication/templates/erb/two_factor_authentication/challenges/_totp_form.html.erb.tt

@@ -1,5 +1,4 @@
 <%%= form_with(url: two_factor_authentication_challenge_path) do |form| %>
-  <%%= form.hidden_field :token, value: params[:token] %>
   <%%= form.hidden_field :scheme_type, value: "totp" %>
 
   <div>
@@ -16,5 +15,5 @@
 
 <div>
   <p><strong>Don't have your phone?</strong></p>
-  <%%= link_to "Use a recovery code to access your account.", new_two_factor_authentication_challenge_path(token: params[:token], scheme_type: "recovery_codes") %>
+  <%%= link_to "Use a recovery code to access your account.", new_two_factor_authentication_challenge_path(scheme_type: "recovery_codes") %>
 </div>

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: authentication-zero
 version: !ruby/object:Gem::Version
-  version: 2.16.17
+  version: 2.16.19
 platform: ruby
 authors:
 - Nixon