Two-factor Authentication (TFA)

Issues

• 🐛

  Resolve test failures from once() called statically

  Active

  Code

  Created 26 days ago

  v2.0
  🇺🇸United States cmlara

  15 days ago
• 🐛

  Email OTP Plugin setup form displayed twice.

  Active

  Code

  Created 3 months ago

  v1.11
  🇬🇧United Kingdom arcaic

  16 days ago
• 🐛

  Deprecations PHP 8.4

  Active

  Code

  Created 9 months ago

  v2.0
  🇮🇳India chandansha

  about 1 month ago
• 🐛

  The "tfa_trusted_browser" plugin does not exist.

  Active

  Code

  Created over 1 year ago

  v1.5
  🇳🇱Netherlands joshahubbers

  about 1 month ago
• 💬

  Invalid session on multi container app

  Active

  Code

  Created about 2 months ago

  v1.0
  🇷🇸Serbia g_miric

  about 2 months ago
• 🌱

  Roadmap for 2.0.0 release

  Active

  Miscellaneous

  Created about 2 years ago

  v2.0
  🇺🇸United States cmlara

  2 months ago
• 🐛

  TfaOverviewForm shows "Disable TFA" link for users without permission

  Active

  User interface

  Created 3 months ago

  v2.0
  jvollebregt-swis

  2 months ago
• 📌

  [July 16th] Public follow-up to SA-CONTRIB-2025-085

  Postponed

  Code

  Created 3 months ago

  v2.0
  🇺🇸United States cmlara

  2 months ago
• 📌

  Fix reliability of storing status in user data

  Active

  Code

  Created 3 months ago

  v2.0
  🇬🇧United Kingdom scott_euser

  2 months ago
• ✨

  Force user to setup TFA when required and there are no remaining skips

  Needs work

  Code

  Created about 4 years ago

  v2.0
  🇧🇬Bulgaria SimeonKesmev

  2 months ago
• 📌

  Use an EventSubscriber to protect one time login links

  Active

  Code

  Created almost 2 years ago

  v2.0
  🇺🇸United States cmlara

  2 months ago
• ✨

  Provide an alter for user settings

  Active

  Code

  Created 3 months ago

  v2.0
  🇺🇦Ukraine AstonVictor

  2 months ago
• 📌

  Support for phpunit 10

  Active

  Code

  Created 3 months ago

  v2.0
  🇬🇧United Kingdom scott_euser

  2 months ago
• 📌

  Public followup for SA-CONTRIB-2024-043

  Postponed

  Code

  Created 12 months ago

  v2.0
  🇺🇸United States cmlara

  2 months ago
• 🐛

  Full Setup not working on 8.x-1.7

  Active

  Code

  Created over 1 year ago

  v1.7
  marcellinostroosnijder

  2 months ago
• ✨

  Disallow viewing recovery codes after first display

  Active

  Code

  Created almost 3 years ago

  v2.0
  🇦🇺Australia dpi

  3 months ago
• 🐛

  Allowing authenticated users access to setup adds misleading message to config form

  Active

  User interface

  Created 4 months ago

  v2.0
  🇬🇧United Kingdom scott_euser

  3 months ago
• 🐛

  When role is changed to require TFA after user has logged-in skip count decreases on each page view

  Active

  Code

  Created 3 months ago

  v2.0
  🇺🇸United States cmlara

  3 months ago
• 📌

  Convert plugins to use PHP Attributes only.

  Active

  Code

  Created almost 2 years ago

  v2.0
  🇺🇸United States cmlara

  3 months ago
• 📌

  Public followup for SA-CONTRIB-2025-023

  Active

  Code

  Created 6 months ago

  v1.0
  🇺🇸United States cmlara

  3 months ago
• ✨

  Make QR account name configurable

  Active

  User interface

  Created over 7 years ago

  v2.0
  🇧🇪Belgium JeroenT

  3 months ago
• 📌

  Remove usage of alreadyAcceptedCode()/storeAccepedCode() in the TOTP,HOTP, Recovery Code plugins.

  Active

  Code

  Created almost 2 years ago

  v2.0
  🇺🇸United States cmlara

  3 months ago
• 🐛

  TfaSetupForm overrides form_state storage

  Active

  Code

  Created over 3 years ago

  v2.0
  🇺🇸United States cmlara

  3 months ago
• 📌

  Evaluate restoring using a form alter instead of extending UserLoginForm

  Active

  Code

  Created almost 2 years ago

  v2.0
  🇺🇸United States cmlara

  3 months ago
• 📌

  Increase minimum requierments for 2.x branch

  Active

  Code

  Created 4 months ago

  v2.0
  🇺🇸United States cmlara

  3 months ago
• 🐛

  Password reset not working

  Active

  Code

  Created over 1 year ago

  v1.7
  🇳🇱Netherlands zebda

  3 months ago
• 🐛

  Number of skipped validations shows when TFA is enabled

  Active

  User interface

  Created 3 months ago

  v2.0
  🇬🇧United Kingdom scott_euser

  3 months ago
• 📌

  Remove referneces to Twillo Authy desktop apps

  Active

  Code

  Created over 1 year ago

  v2.0
  🇺🇸United States cmlara

  3 months ago
• ✨

  Login plugin to skip TFA from trusted IP addresses

  Needs work

  Code

  Created over 6 years ago

  v2.0
  🇳🇱Netherlands e.ruiter

  3 months ago
• 📌

  Invalid application code if time is out of sync on server and client

  Active

  Documentation

  Created over 7 years ago

  v2.0
  yfaouzi

  3 months ago
• 🐛

  testTfaLogin() sendin fields that do not exist to TFA Config form

  Active

  Code

  Created 3 months ago

  v2.0
  🇺🇸United States cmlara

  3 months ago
• 🐛

  Compatibility with Drush 13

  Active

  Code

  Created 7 months ago

  v1.9
  🇷🇸Serbia ratvas

  3 months ago
• 📌

  Incorrect typehint \Drupal\encrypt\EncryptionProfileInterface

  Needs review

  Code

  Created over 1 year ago

  v1.0
  🇺🇸United States andyg5000

  3 months ago
• ✨

  Tugboat previews

  Active

  Code

  Created 6 months ago

  v2.0
  🇺🇸United States dmundra

  4 months ago
• 🐛

  plugin_label missing in feedback when TFA setup is canceled

  Active

  Code

  Created 11 months ago

  v1.9
  🇩🇪Germany lmoeni

  4 months ago
• ✨

  QR code difficult to see on dark mode themes

  Active

  User interface

  Created about 1 year ago

  v1.0
  🇳🇿New Zealand chroid

  4 months ago
• ✨

  Option to disable TFA when requesting new password

  Active

  Code

  Created 4 months ago

  v2.0
  🇳🇱Netherlands edvanleeuwen

  4 months ago
• ✨

  Document how to use TFA with REST

  Active

  Code

  Created 5 months ago

  v2.0
  🇬🇧United Kingdom scott_euser

  4 months ago
• 🐛

  Issuer field not configured

  Active

  Code

  Created almost 2 years ago

  v1.2
  🇫🇷France slayne40

  4 months ago
• ✨

  User account should be marked as updated when TFA is updated

  Active

  Code

  Created about 9 years ago

  v2.0
  🇨🇦Canada cdeces

  4 months ago
• 📌

  Fix composer deprecation warning

  Active

  Code

  Created 5 months ago

  v2.0
  🇬🇧United Kingdom scott_euser

  4 months ago
• 📌

  Support chillerlan/php-qrcode 5.x

  Active

  Code

  Created 4 months ago

  v2.0
  🇺🇸United States mortona2k

  4 months ago
• 🐛

  Change heading hierarchy for accessibility purposes

  Active

  Code

  Created 11 months ago

  v1.9
  🇩🇪Germany lmoeni

  4 months ago
• 🐛

  Resolve SA-CONTRIB-2024-003 in 2.x branch

  Postponed

  Code

  Created over 1 year ago

  v2.0
  🇺🇸United States cmlara

  4 months ago
• 📌

  Cleanup PHPStan Baseline

  Active

  Code

  Created 5 months ago

  v1.0
  🇺🇸United States cmlara

  4 months ago
• 📌

  Fix install instruction on project-page

  Active

  Documentation

  Created over 1 year ago

  v1.0
  🇳🇱Netherlands joshahubbers

  4 months ago
• ✨

  Add client IP address as criteria for invalidating TFA

  Active

  User interface

  Created almost 3 years ago

  v2.0
  🇺🇸United States damienmckenna

  4 months ago
• 🐛

  TFA enabled config not set on user profile

  Active

  Code

  Created about 2 years ago

  v2.0
  🇬🇧United Kingdom xiwar

  4 months ago
• 🐛

  The "skip step"/"skip and finish" button UX is confusing because the error "TFA setup canceled" is then shown when clicked

  Active

  User interface

  Created over 1 year ago

  v1.0
  🇬🇧United Kingdom alexharries

  4 months ago
• ✨

  Invalidate other sessions when a user enables TFA

  Active

  Code

  Created about 6 years ago

  v2.0
  🇬🇧United Kingdom mcdruid

  4 months ago
• 💬

  Migration from Drupal 7 to Drupal 9

  Active

  Miscellaneous

  Created almost 3 years ago

  v1.0
  🇺🇸United States jsutta

  4 months ago
• 📌

  Disable Cache

  Closed: cannot reproduce

  Code

  Created about 6 years ago

  v2.0
  🇪🇬Egypt ahmed-ayman

  4 months ago
• 🐛

  404 on user password form after being forced to set up TFA with 0 attempts left

  Closed: works as designed

  Code

  Created over 7 years ago

  v2.0
  🇺🇸United States ryan.ryan

  4 months ago
• 🐛

  Implement Drupal\user\UserAuthenticationInterface

  Needs review

  Code

  Created 9 months ago

  v2.0
  🇭🇺Hungary imre.horjan

  4 months ago
• 🐛

  Redirect to TFA doesn't work with login destination modules

  Active

  Code

  Created 11 months ago

  v1.9
  🇧🇾Belarus gun_dose

  4 months ago
• 🐛

  One setup step remaining, two QR Code Scans required

  Active

  User interface

  Created 12 months ago

  v1.8
  🇺🇸United States cmarcera

  4 months ago
• 🐛

  TFA setup not fully accessible

  Active

  User interface

  Created 5 months ago

  v2.0
  🇫🇷France bedlam

  5 months ago
• 🐛

  Insufficient entropy in loginHash generation

  Active

  Code

  Created 7 months ago

  v2.0
  🇺🇸United States cmlara

  5 months ago
• 🐛

  ParagonIE\ConstantTime\Encoding dependency not installed from TFA

  Needs review

  Code

  Created 9 months ago

  v1.9
  seeduardo

  5 months ago
• 🐛

  Class 'Base32\Base32' not found - switch library to paragonie/constant_time_encoding

  Fixed

  Code

  Created almost 8 years ago

  v1.0
  🇺🇸United States daggerhart

  5 months ago
• 🐛

  Only show default plugin when TFA disabled and hide skip validation attempts if disabled

  Active

  Code

  Created 12 months ago

  v2.0
  🇺🇸United States jsutta

  5 months ago
• 📌

  Can we get a new release?

  Active

  Code

  Created 5 months ago

  v2.0
  🇳🇿New Zealand Gold

  5 months ago
• 🐛

  TFA Pages: Mermaid graphs not loading

  Active

  Documentation

  Created 12 months ago

  v2.0
  🇺🇸United States cmlara

  6 months ago
• 🐛

  TFA gets automatically disabled for all users.

  Active

  Code

  Created 10 months ago

  v1.8
  🇮🇳India lomasr

  6 months ago
• 📌

  TfaPluginManager should use ConfigFactory not ImmutableConfig

  Active

  Code

  Created 7 months ago

  v2.0
  🇺🇸United States cmlara

  6 months ago
• 🐛

  Fix isTfaDisabled

  Active

  Code

  Created 6 months ago

  v1.10
  🇨🇭Switzerland milanbombschliip

  6 months ago
• 💬

  Can we switch site from 2.0.0-apha2 to 8.x-1.7?

  Active

  Documentation

  Created 12 months ago

  v2.0
  🇬🇧United Kingdom arcaic

  7 months ago
• 📌

  Create "Email one-time-code" Validation Plugin & related Setup Plugin

  Needs work

  Code

  Created almost 8 years ago

  v2.0
  🇺🇸United States daggerhart

  7 months ago
• 📌

  Cleanup cSpell GitLab Warnings

  Active

  Miscellaneous

  Created 10 months ago

  v2.0
  🇺🇸United States cmlara

  7 months ago
• 📌

  Revert PHPUnit Stage to not use core phpunit.xml

  Active

  User interface

  Created 8 months ago

  v2.0
  🇺🇸United States cmlara

  7 months ago
• ✨

  provide an option to skip sql sanitization for tfa

  Needs work

  Code

  Created over 2 years ago

  v2.0
  🇮🇳India shivamitakari

  7 months ago
• 🐛

  TfaLoginController enforces opaque form expiration

  Active

  Code

  Created almost 2 years ago

  v2.0
  🇩🇪Germany giuspe

  7 months ago
• ✨

  Support `user.reset` route that can be used by Drush or Simple Pass Reset module

  Needs work

  Code

  Created 7 months ago

  v1.0
  🇰🇬Kyrgyzstan elaman

  7 months ago
• ✨

  TFA only overwrites user.login

  Active

  Code

  Created 7 months ago

  v1.9
  🇳🇱Netherlands makertimswis

  7 months ago
• ✨

  Allow Bypassing Password Confirmation for 2FA Setup for SSO-Authenticated Users

  Needs work

  Code

  Created 8 months ago

  v1.9
  🇮🇳India hardik_patel_12

  8 months ago
• ✨

  Add ECA condition plugin "is TFA setup"

  Active

  Code

  Created almost 2 years ago

  v2.0
  🇦🇺Australia sime

  8 months ago
• ✨

  Ignore roles feature

  Needs review

  Code

  Created 8 months ago

  v1.9
  🇲🇩Moldova nick.murza

  8 months ago
• 🐛

  Original page lost after TOTP authentication

  Active

  Code

  Created over 9 years ago

  v2.0
  🇺🇸United States rocketeerbkw

  8 months ago
• 💬

  TFA to confirm action

  Closed: outdated

  Documentation

  Created almost 11 years ago

  v2.0
  🇦🇪United Arab Emirates johnkareoke

  8 months ago
• 🐛

  UI feedback ("Login disallowed") can disappear

  Closed: outdated

  Code

  Created about 10 years ago

  v2.0
  🇳🇱Netherlands eelkeblok

  8 months ago
• 📌

  Make secondary action less prominent on 2nd-factor input form during login

  Closed: outdated

  User interface

  Created about 10 years ago

  v2.0
  🇺🇸United States sreynen

  8 months ago
• ✨

  Protect only admin paths, without forced logout.

  Closed: outdated

  Code

  Created over 7 years ago

  v2.0
  🇺🇸United States swirt

  8 months ago
• 💬

  Edit emails sent by TFA

  Closed: outdated

  User interface

  Created over 4 years ago

  v2.1
  🇬🇧United Kingdom sksshed

  8 months ago
• 🐛

  Documentation Error

  Closed: outdated

  Documentation

  Created over 9 years ago

  v2.0
  hoopy21

  8 months ago
• 💬

  OAuth2 server support - require TFA for Password Credentials grant type

  Closed: outdated

  Code

  Created over 10 years ago

  v2.0
  🇬🇧United Kingdom pjcdawkins

  8 months ago
• ✨

  Non-unique accounts

  Closed: outdated

  Code

  Created over 6 years ago

  v2.0
  🇳🇱Netherlands edvanleeuwen

  8 months ago
• 📌

  Create a flood limit for a user which blocks that account from logging in with a new browser

  Closed: outdated

  Code

  Created about 11 years ago

  v2.0
  🇺🇸United States greggles

  8 months ago
• 🐛

  Undefined property error logging out

  Closed: outdated

  Code

  Created about 5 years ago

  v
  🇳🇱Netherlands edvanleeuwen

  8 months ago
• 💬

  How do I require TFA for new registrations?

  Closed: outdated

  Code

  Created about 5 years ago

  v2.0
  🇺🇸United States joegl

  8 months ago
• 💬

  User is redirected to TFA page after login even with TFA disabled

  Closed: outdated

  User interface

  Created over 6 years ago

  v2.0
  🇬🇧United Kingdom sksshed

  8 months ago
• ✨

  Preserve form_state of login form for compatibility with other modules

  Closed: outdated

  Code

  Created over 4 years ago

  v2.0
  🇷🇴Romania reszli

  8 months ago
• 💬

  TFA Session expired

  Active

  User interface

  Created about 2 years ago

  v2.3
  derrick.iverson.dev@gmail.com

  8 months ago
• 🐛

  Self-service password reset not working when tfa is enabled

  Active

  Code

  Created over 6 years ago

  v2.0
  🇺🇸United States anthonyf

  8 months ago
• 📌

  Context alter documentaion missing

  Needs review

  Documentation

  Created over 10 years ago

  v2.0
  🇮🇳India subhojit777

  8 months ago
• 🐛

  Access to TFA page is denied

  Active

  Code

  Created 9 months ago

  v1.9
  🇳🇱Netherlands zebda

  9 months ago
• 📌

  Encourage the use of ssl to avoid replay attacks

  Active

  Documentation

  Created about 11 years ago

  v2.0
  🇺🇸United States greggles

  9 months ago
• 🐛

  Redirect correctly after first time plugin setup

  Needs review

  Code

  Created 10 months ago

  v2.0
  🇬🇧United Kingdom Dubs

  9 months ago
• 🐛

  Contrib modules can bypass TFA authentication

  Active

  Code

  Created over 1 year ago

  v2.0
  🇺🇸United States cmlara

  9 months ago
• 🌱

  PHP 7.0 Support

  Active

  Code

  Created 9 months ago

  v1.0
  🇺🇸United States cmlara

  9 months ago
• ✨

  Create option to bypass the password check during TFA setup

  Closed: duplicate

  Code

  Created over 7 years ago

  v2.0
  🇺🇸United States swirt

  9 months ago