Two-factor Authentication (TFA)

Issues

• 🐛

  One setup step remaining, two QR Code Scans required

  Active

  User interface

  Created 7 months ago

  v1.8
  🇺🇸United States cmarcera

  1 day ago
• ✨

  Document how to use TFA with REST

  Active

  Code

  Created 19 days ago

  v2.0
  🇬🇧United Kingdom scott_euser

  11 days ago
• 🐛

  TFA setup not fully accessible

  Active

  User interface

  Created 13 days ago

  v2.0
  🇫🇷France bedlam

  13 days ago
• 🐛

  Insufficient entropy in loginHash generation

  Active

  Code

  Created 3 months ago

  v2.0
  🇺🇸United States cmlara

  14 days ago
• 📌

  Cleanup PHPStan Baseline

  Active

  Code

  Created 27 days ago

  v1.0
  🇺🇸United States cmlara

  14 days ago
• 🐛

  ParagonIE\ConstantTime\Encoding dependency not installed from TFA

  Needs review

  Code

  Created 4 months ago

  v1.9
  seeduardo

  17 days ago
• 🌱

  Roadmap for 2.0.0 release

  Active

  Miscellaneous

  Created almost 2 years ago

  v2.0
  🇺🇸United States cmlara

  19 days ago
• 🐛

  Resolve SA-CONTRIB-2024-003 in 2.x branch

  Postponed

  Code

  Created over 1 year ago

  v2.0
  🇺🇸United States cmlara

  19 days ago
• 📌

  Fix composer deprecation warning

  Active

  Code

  Created 19 days ago

  v2.0
  🇬🇧United Kingdom scott_euser

  19 days ago
• 🐛

  Password reset not working

  Active

  Code

  Created about 1 year ago

  v1.7
  🇳🇱Netherlands zebda

  21 days ago
• ✨

  Login plugin to skip TFA from trusted IP addresses

  Needs work

  Code

  Created almost 6 years ago

  v2.0
  🇳🇱Netherlands e.ruiter

  23 days ago
• 📌

  Use an EventSubscriber to protect one time login links

  Active

  Code

  Created over 1 year ago

  v2.0
  🇺🇸United States cmlara

  23 days ago
• 🐛

  Class 'Base32\Base32' not found - switch library to paragonie/constant_time_encoding

  Fixed

  Code

  Created over 7 years ago

  v1.0
  🇺🇸United States daggerhart

  23 days ago
• 🐛

  Only show default plugin when TFA disabled and hide skip validation attempts if disabled

  Active

  Code

  Created 8 months ago

  v2.0
  🇺🇸United States jsutta

  24 days ago
• 📌

  Can we get a new release?

  Active

  Code

  Created about 1 month ago

  v2.0
  🇳🇿New Zealand Gold

  about 1 month ago
• 🐛

  TFA Pages: Mermaid graphs not loading

  Active

  Documentation

  Created 7 months ago

  v2.0
  🇺🇸United States cmlara

  about 1 month ago
• ✨

  Tugboat previews

  Active

  Code

  Created about 2 months ago

  v2.0
  🇺🇸United States dmundra

  about 2 months ago
• 🐛

  TFA gets automatically disabled for all users.

  Active

  Code

  Created 5 months ago

  v1.8
  🇮🇳India lomasr

  about 2 months ago
• 📌

  TfaPluginManager should use ConfigFactory not ImmutableConfig

  Active

  Code

  Created 2 months ago

  v2.0
  🇺🇸United States cmlara

  about 2 months ago
• 📌

  Public followup for SA-CONTRIB-2025-023

  Active

  Code

  Created about 2 months ago

  v1.0
  🇺🇸United States cmlara

  about 2 months ago
• 🐛

  Fix isTfaDisabled

  Active

  Code

  Created 2 months ago

  v1.10
  🇨🇭Switzerland milanbombschliip

  2 months ago
• 💬

  Can we switch site from 2.0.0-apha2 to 8.x-1.7?

  Active

  Documentation

  Created 8 months ago

  v2.0
  🇬🇧United Kingdom arcaic

  2 months ago
• 🐛

  Compatibility with Drush 13

  Active

  Code

  Created 3 months ago

  v1.9
  🇷🇸Serbia ratvas

  3 months ago
• 📌

  Create "Email one-time-code" Validation Plugin & related Setup Plugin

  Needs work

  Code

  Created over 7 years ago

  v2.0
  🇺🇸United States daggerhart

  3 months ago
• 📌

  Cleanup cSpell GitLab Warnings

  Active

  Miscellaneous

  Created 5 months ago

  v2.0
  🇺🇸United States cmlara

  3 months ago
• 📌

  Revert PHPUnit Stage to not use core phpunit.xml

  Active

  User interface

  Created 3 months ago

  v2.0
  🇺🇸United States cmlara

  3 months ago
• ✨

  provide an option to skip sql sanitization for tfa

  Needs work

  Code

  Created about 2 years ago

  v2.0
  🇮🇳India shivamitakari

  3 months ago
• 🐛

  TfaLoginController enforces opaque form expiration

  Active

  Code

  Created over 1 year ago

  v2.0
  🇩🇪Germany giuspe

  3 months ago
• 🐛

  Deprecations PHP 8.4

  Active

  Code

  Created 5 months ago

  v2.0
  🇮🇳India chandansha

  3 months ago
• ✨

  Support `user.reset` route that can be used by Drush or Simple Pass Reset module

  Needs work

  Code

  Created 3 months ago

  v1.0
  🇰🇬Kyrgyzstan elaman

  3 months ago
• ✨

  TFA only overwrites user.login

  Active

  Code

  Created 3 months ago

  v1.9
  🇳🇱Netherlands makertimswis

  3 months ago
• 📌

  Public followup for SA-CONTRIB-2024-043

  Postponed

  Code

  Created 7 months ago

  v2.0
  🇺🇸United States cmlara

  3 months ago
• 🐛

  Redirect to TFA doesn't work with login destination modules

  Active

  Code

  Created 6 months ago

  v1.9
  🇧🇾Belarus gun_dose

  3 months ago
• ✨

  Allow Bypassing Password Confirmation for 2FA Setup for SSO-Authenticated Users

  Needs work

  Code

  Created 3 months ago

  v1.9
  🇮🇳India hardik_patel_12

  3 months ago
• ✨

  Add ECA condition plugin "is TFA setup"

  Active

  Code

  Created over 1 year ago

  v2.0
  🇦🇺Australia sime

  3 months ago
• ✨

  Ignore roles feature

  Needs review

  Code

  Created 4 months ago

  v1.9
  🇲🇩Moldova nick.murza

  4 months ago
• 🐛

  Original page lost after TOTP authentication

  Active

  Code

  Created about 9 years ago

  v2.0
  🇺🇸United States rocketeerbkw

  4 months ago
• 💬

  TFA to confirm action

  Closed: outdated

  Documentation

  Created over 10 years ago

  v2.0
  🇦🇪United Arab Emirates johnkareoke

  4 months ago
• 🐛

  UI feedback ("Login disallowed") can disappear

  Closed: outdated

  Code

  Created over 9 years ago

  v2.0
  🇳🇱Netherlands eelkeblok

  4 months ago
• 📌

  Make secondary action less prominent on 2nd-factor input form during login

  Closed: outdated

  User interface

  Created over 9 years ago

  v2.0
  🇺🇸United States sreynen

  4 months ago
• ✨

  Protect only admin paths, without forced logout.

  Closed: outdated

  Code

  Created almost 7 years ago

  v2.0
  🇺🇸United States swirt

  4 months ago
• 💬

  Edit emails sent by TFA

  Closed: outdated

  User interface

  Created about 4 years ago

  v2.1
  🇬🇧United Kingdom sksshed

  4 months ago
• 🐛

  Documentation Error

  Closed: outdated

  Documentation

  Created over 9 years ago

  v2.0
  hoopy21

  4 months ago
• 💬

  OAuth2 server support - require TFA for Password Credentials grant type

  Closed: outdated

  Code

  Created about 10 years ago

  v2.0
  🇬🇧United Kingdom pjcdawkins

  4 months ago
• ✨

  Non-unique accounts

  Closed: outdated

  Code

  Created about 6 years ago

  v2.0
  🇳🇱Netherlands edvanleeuwen

  4 months ago
• 📌

  Create a flood limit for a user which blocks that account from logging in with a new browser

  Closed: outdated

  Code

  Created over 10 years ago

  v2.0
  🇺🇸United States greggles

  4 months ago
• 📌

  Invalid application code if time is out of sync on server and client

  Active

  Documentation

  Created over 7 years ago

  v2.0
  yfaouzi

  4 months ago
• 🐛

  Undefined property error logging out

  Closed: outdated

  Code

  Created over 4 years ago

  v
  🇳🇱Netherlands edvanleeuwen

  4 months ago
• 💬

  How do I require TFA for new registrations?

  Closed: outdated

  Code

  Created over 4 years ago

  v2.0
  🇺🇸United States joegl

  4 months ago
• 💬

  User is redirected to TFA page after login even with TFA disabled

  Closed: outdated

  User interface

  Created over 6 years ago

  v2.0
  🇬🇧United Kingdom sksshed

  4 months ago
• ✨

  Preserve form_state of login form for compatibility with other modules

  Closed: outdated

  Code

  Created almost 4 years ago

  v2.0
  🇷🇴Romania reszli

  4 months ago
• 💬

  TFA Session expired

  Active

  User interface

  Created over 1 year ago

  v2.3
  derrick.iverson.dev@gmail.com

  4 months ago
• 🐛

  Self-service password reset not working when tfa is enabled

  Active

  Code

  Created about 6 years ago

  v2.0
  🇺🇸United States anthonyf

  4 months ago
• 📌

  Context alter documentaion missing

  Needs review

  Documentation

  Created over 10 years ago

  v2.0
  🇮🇳India subhojit777

  4 months ago
• 🐛

  Access to TFA page is denied

  Active

  Code

  Created 4 months ago

  v1.9
  🇳🇱Netherlands zebda

  4 months ago
• 🐛

  Implement Drupal\user\UserAuthenticationInterface

  Needs review

  Code

  Created 4 months ago

  v2.0
  🇭🇺Hungary imre.horjan

  4 months ago
• 📌

  Encourage the use of ssl to avoid replay attacks

  Active

  Documentation

  Created over 10 years ago

  v2.0
  🇺🇸United States greggles

  4 months ago
• 🐛

  Redirect correctly after first time plugin setup

  Needs review

  Code

  Created 6 months ago

  v2.0
  🇬🇧United Kingdom Dubs

  4 months ago
• 🐛

  Contrib modules can bypass TFA authentication

  Active

  Code

  Created over 1 year ago

  v2.0
  🇺🇸United States cmlara

  4 months ago
• 🌱

  PHP 7.0 Support

  Active

  Code

  Created 5 months ago

  v1.0
  🇺🇸United States cmlara

  5 months ago
• ✨

  Create option to bypass the password check during TFA setup

  Closed: duplicate

  Code

  Created almost 7 years ago

  v2.0
  🇺🇸United States swirt

  5 months ago
• ✨

  Allow admins to set up TFA for other users in bulk

  Active

  Code

  Created over 6 years ago

  v2.0
  🇬🇧United Kingdom hoegrammer

  5 months ago
• ✨

  Allow users to setup TFA along with registration

  Active

  Code

  Created about 6 years ago

  v2.0
  🇺🇸United States jadhavdevendra

  5 months ago
• ✨

  Option to require SSL connection to show Recovery codes, or insist on sending them through email instead

  Active

  Code

  Created almost 10 years ago

  v2.0
  Leeteq

  5 months ago
• 💬

  Do you plan to support SMS based TFA validation?

  Closed: works as designed

  Documentation

  Created almost 3 years ago

  v1.0
  🇬🇧United Kingdom Syntapse

  5 months ago
• 📌

  Drupal Core Tests now use one time login links instead of user form

  Active

  Code

  Created 7 months ago

  v2.0
  🇺🇸United States cmlara

  5 months ago
• 📌

  Cleanup TfaUserDataTrait phpstan warnings

  Active

  Code

  Created 5 months ago

  v2.0
  🇺🇸United States cmlara

  5 months ago
• ✨

  Add D11 Support

  Active

  Code

  Created 12 months ago

  v1.0
  🇺🇸United States cmlara

  5 months ago
• 📌

  Use #config_target for the settings form

  Active

  Code

  Created 5 months ago

  v2.0
  🇳🇱Netherlands idebr

  5 months ago
• 🐛

  Admin cannot disable TFA for a user

  Active

  Code

  Created 6 months ago

  v1.0
  🇳🇿New Zealand RoSk0

  5 months ago
• 🐛

  Full Setup not working on 8.x-1.7

  Active

  Code

  Created 12 months ago

  v1.7
  marcellinostroosnijder

  6 months ago
• ✨

  Allow modules to skip TFA through a hook

  Active

  Code

  Created about 1 year ago

  v1.0
  🇦🇹Austria jordik

  6 months ago
• 🐛

  You are not authorized to access this page on remote only

  Active

  User interface

  Created about 1 year ago

  v1.7
  🇳🇱Netherlands zebda

  6 months ago
• 📌

  Add a Views filter for the 'TFA enabled' field

  Active

  Code

  Created over 5 years ago

  v2.0
  🇳🇱Netherlands idebr

  6 months ago
• 💬

  Get boolean if TFA is set?

  Closed: outdated

  Code

  Created about 6 years ago

  v
  🇧🇬Bulgaria JustViktor

  7 months ago
• 📌

  Automated Drupal 11 compatibility fixes for tfa

  Needs review

  Code

  Created 10 months ago

  v1.0
  project update bot

  7 months ago
• 🐛

  plugin_label missing in feedback when TFA setup is canceled

  Active

  Code

  Created 7 months ago

  v1.9
  🇩🇪Germany lmoeni

  7 months ago
• 🐛

  Change heading hierarchy for accessibility purposes

  Active

  Code

  Created 7 months ago

  v1.9
  🇩🇪Germany lmoeni

  7 months ago
• 📌

  SA-CONTRIB-2023-030 and 2.x

  Active

  Code

  Created almost 2 years ago

  v2.0
  🇺🇸United States cmlara

  7 months ago
• 💬

  How to enable plugins

  Active

  Documentation

  Created 7 months ago

  v1.0
  stefan927

  7 months ago
• ✨

  Confirmation forms should not require passwords

  Needs review

  Code

  Created over 7 years ago

  v2.0
  🇺🇸United States benjifisher

  7 months ago
• 📌

  Fix Code Coverage reporting

  Active

  Code

  Created 8 months ago

  v1.0
  🇺🇸United States cmlara

  7 months ago
• ✨

  Allow Drush uli login command to bypass TFA

  Needs work

  Code

  Created about 10 years ago

  v2.0
  🇨🇦Canada scor

  7 months ago
• 💬

  TFA branch 2 reported by drupal.org as affected by SA-CONTRIB-2023-030

  Active

  Documentation

  Created 7 months ago

  v2.0
  🇪🇸Spain pcambra

  7 months ago
• 📌

  The official abbreviation is 2FA

  Active

  User interface

  Created over 2 years ago

  v2.0
  🇭🇺Hungary pasqualle

  7 months ago
• 🐛

  Respect DB prefix for running drush sql:sanitize

  Fixed

  Code

  Created over 2 years ago

  v2.0
  🇬🇧United Kingdom somersoft

  7 months ago
• 🦘

  Two-factor Authentication (TFA) - Critical - Access bypass - SA-CONTRIB-2024-043

  Fixed

  Missing component

  Created 7 months ago

  v
  Drupal Security Team

  7 months ago
• ✨

  Allow use with Email Registration module

  Active

  Code

  Created 8 months ago

  v1.0
  🇯🇵Japan ptmkenny

  8 months ago
• 🐛

  Check if Help module is enabled

  Fixed

  User interface

  Created over 9 years ago

  v2.0
  🇳🇱Netherlands michaelmol

  8 months ago
• 🐛

  Incompatibility with mail_login module using REST login

  Active

  Code

  Created 8 months ago

  v1.7
  🇺🇸United States delzhand

  8 months ago
• 🐛

  when doing drush uli get "Unexpected Access Fault"

  Closed: duplicate

  Code

  Created 8 months ago

  v2.0
  🇺🇸United States dianacastillo

  8 months ago
• 🐛

  2.x-dev incompatible with other modules calling user_login_finalize()

  Fixed

  Code

  Created about 1 year ago

  v2.0
  🇺🇸United States grasmash

  8 months ago
• 🐛

  TfaTokenManagement::__construct(): Argument #4 ($logger) should allow \Psr\Log\LoggerInterface

  Fixed

  Code

  Created 10 months ago

  v2.0
  🇺🇸United States beunerd

  8 months ago
• 📌

  Remove 'sms' from tfa_user_settings

  Fixed

  Code

  Created over 1 year ago

  v2.0
  🇺🇸United States cmlara

  8 months ago
• 🐛

  The "tfa_trusted_browser" plugin does not exist.

  Needs work

  Code

  Created about 1 year ago

  v1.5
  🇳🇱Netherlands joshahubbers

  8 months ago
• ✨

  Force user to setup TFA when required and there are no remaining skips

  Needs work

  Code

  Created almost 4 years ago

  v2.0
  🇧🇬Bulgaria SimeonKesmev

  8 months ago
• ✨

  Support Simple Password Reset module

  Postponed

  Code

  Created 8 months ago

  v2.0
  🇰🇬Kyrgyzstan elaman

  8 months ago
• 🐛

  error when hitting login button after requesting a password reset

  Closed: duplicate

  Code

  Created 11 months ago

  v2.0
  🇺🇸United States dianacastillo

  8 months ago
• 🐛

  Encrypt error with php 8.1

  Closed: cannot reproduce

  Code

  Created over 1 year ago

  v1.0
  🇳🇱Netherlands zebda

  8 months ago
• 💬

  Adjust the deny access time limit with tfa email plugin for a user

  Closed: duplicate

  Code

  Created 9 months ago

  v1.0
  🇦🇺Australia Nadim Hossain

  9 months ago