Two-factor Authentication (TFA)

Issues

• ✨

  Provide an alter for user settings

  Active

  Code

  Created about 6 hours ago

  v2.0
  🇺🇦Ukraine AstonVictor

  about 6 hours ago
• 📌

  Remove usage of alreadyAcceptedCode()/storeAccepedCode() in the TOTP,HOTP, Recovery Code plugins.

  Active

  Code

  Created over 1 year ago

  v2.0
  🇺🇸United States cmlara

  2 days ago
• 🐛

  TfaSetupForm overrides form_state storage

  Active

  Code

  Created about 3 years ago

  v2.0
  🇺🇸United States cmlara

  2 days ago
• 📌

  Evaluate restoring using a form alter instead of extending UserLoginForm

  Active

  Code

  Created over 1 year ago

  v2.0
  🇺🇸United States cmlara

  4 days ago
• 📌

  Increase minimum requierments for 2.x branch

  Active

  Code

  Created 25 days ago

  v2.0
  🇺🇸United States cmlara

  4 days ago
• 🐛

  TfaOverviewForm shows "Disable TFA" link for users without permission

  Active

  User interface

  Created 7 days ago

  v2.0
  jvollebregt-swis

  7 days ago
• 🐛

  Allowing authenticated users access to setup adds misleading message to config form

  Active

  User interface

  Created 24 days ago

  v2.0
  🇬🇧United Kingdom scott_euser

  7 days ago
• 🐛

  Password reset not working

  Active

  Code

  Created about 1 year ago

  v1.7
  🇳🇱Netherlands zebda

  8 days ago
• 📌

  Public followup for SA-CONTRIB-2024-043

  Postponed

  Code

  Created 9 months ago

  v2.0
  🇺🇸United States cmlara

  9 days ago
• 🐛

  Number of skipped validations shows when TFA is enabled

  Active

  User interface

  Created 9 days ago

  v2.0
  🇬🇧United Kingdom scott_euser

  9 days ago
• ✨

  Make QR account name configurable

  Active

  User interface

  Created about 7 years ago

  v2.0
  🇧🇪Belgium JeroenT

  10 days ago
• 📌

  Public followup for SA-CONTRIB-2025-023

  Active

  Code

  Created 3 months ago

  v1.0
  🇺🇸United States cmlara

  10 days ago
• 📌

  Remove referneces to Twillo Authy desktop apps

  Active

  Code

  Created over 1 year ago

  v2.0
  🇺🇸United States cmlara

  10 days ago
• ✨

  Login plugin to skip TFA from trusted IP addresses

  Needs work

  Code

  Created about 6 years ago

  v2.0
  🇳🇱Netherlands e.ruiter

  12 days ago
• 📌

  Convert plugins to use PHP Attributes only.

  Active

  Code

  Created over 1 year ago

  v2.0
  🇺🇸United States cmlara

  12 days ago
• 📌

  Invalid application code if time is out of sync on server and client

  Active

  Documentation

  Created over 7 years ago

  v2.0
  yfaouzi

  14 days ago
• 🐛

  testTfaLogin() sendin fields that do not exist to TFA Config form

  Active

  Code

  Created 14 days ago

  v2.0
  🇺🇸United States cmlara

  14 days ago
• 🐛

  Compatibility with Drush 13

  Active

  Code

  Created 4 months ago

  v1.9
  🇷🇸Serbia ratvas

  16 days ago
• 📌

  Incorrect typehint \Drupal\encrypt\EncryptionProfileInterface

  Needs review

  Code

  Created about 1 year ago

  v1.0
  🇺🇸United States andyg5000

  18 days ago
• ✨

  Tugboat previews

  Active

  Code

  Created 3 months ago

  v2.0
  🇺🇸United States dmundra

  22 days ago
• 🐛

  plugin_label missing in feedback when TFA setup is canceled

  Active

  Code

  Created 8 months ago

  v1.9
  🇩🇪Germany lmoeni

  22 days ago
• ✨

  QR code difficult to see on dark mode themes

  Active

  User interface

  Created 11 months ago

  v1.0
  🇳🇿New Zealand chroid

  22 days ago
• ✨

  Option to disable TFA when requesting new password

  Active

  Code

  Created 24 days ago

  v2.0
  🇳🇱Netherlands edvanleeuwen

  23 days ago
• ✨

  Document how to use TFA with REST

  Active

  Code

  Created 2 months ago

  v2.0
  🇬🇧United Kingdom scott_euser

  24 days ago
• 🐛

  Issuer field not configured

  Active

  Code

  Created over 1 year ago

  v1.2
  🇫🇷France slayne40

  24 days ago
• ✨

  User account should be marked as updated when TFA is updated

  Active

  Code

  Created almost 9 years ago

  v2.0
  🇨🇦Canada cdeces

  25 days ago
• 📌

  Fix composer deprecation warning

  Active

  Code

  Created 2 months ago

  v2.0
  🇬🇧United Kingdom scott_euser

  25 days ago
• 📌

  Support chillerlan/php-qrcode 5.x

  Active

  Code

  Created 26 days ago

  v2.0
  🇺🇸United States mortona2k

  26 days ago
• 🐛

  Change heading hierarchy for accessibility purposes

  Active

  Code

  Created 8 months ago

  v1.9
  🇩🇪Germany lmoeni

  27 days ago
• 🐛

  Resolve SA-CONTRIB-2024-003 in 2.x branch

  Postponed

  Code

  Created over 1 year ago

  v2.0
  🇺🇸United States cmlara

  28 days ago
• 📌

  Cleanup PHPStan Baseline

  Active

  Code

  Created 2 months ago

  v1.0
  🇺🇸United States cmlara

  28 days ago
• 📌

  Fix install instruction on project-page

  Active

  Documentation

  Created over 1 year ago

  v1.0
  🇳🇱Netherlands joshahubbers

  28 days ago
• ✨

  Add client IP address as criteria for invalidating TFA

  Active

  User interface

  Created over 2 years ago

  v2.0
  🇺🇸United States damienmckenna

  30 days ago
• 🐛

  Full Setup not working on 8.x-1.7

  Active

  Code

  Created about 1 year ago

  v1.7
  marcellinostroosnijder

  about 1 month ago
• 🐛

  TFA enabled config not set on user profile

  Active

  Code

  Created about 2 years ago

  v2.0
  🇬🇧United Kingdom xiwar

  about 1 month ago
• 🐛

  The "skip step"/"skip and finish" button UX is confusing because the error "TFA setup canceled" is then shown when clicked

  Active

  User interface

  Created over 1 year ago

  v1.0
  🇬🇧United Kingdom alexharries

  about 1 month ago
• ✨

  Invalidate other sessions when a user enables TFA

  Active

  Code

  Created almost 6 years ago

  v2.0
  🇬🇧United Kingdom mcdruid

  about 1 month ago
• 💬

  Migration from Drupal 7 to Drupal 9

  Active

  Miscellaneous

  Created over 2 years ago

  v1.0
  🇺🇸United States jsutta

  about 1 month ago
• 📌

  Disable Cache

  Closed: cannot reproduce

  Code

  Created almost 6 years ago

  v2.0
  🇪🇬Egypt ahmed-ayman

  about 1 month ago
• 🐛

  404 on user password form after being forced to set up TFA with 0 attempts left

  Closed: works as designed

  Code

  Created over 7 years ago

  v2.0
  🇺🇸United States ryan.ryan

  about 1 month ago
• 🐛

  Implement Drupal\user\UserAuthenticationInterface

  Needs review

  Code

  Created 6 months ago

  v2.0
  🇭🇺Hungary imre.horjan

  about 1 month ago
• 🐛

  Redirect to TFA doesn't work with login destination modules

  Active

  Code

  Created 8 months ago

  v1.9
  🇧🇾Belarus gun_dose

  about 1 month ago
• 🐛

  One setup step remaining, two QR Code Scans required

  Active

  User interface

  Created 9 months ago

  v1.8
  🇺🇸United States cmarcera

  about 1 month ago
• 🐛

  TFA setup not fully accessible

  Active

  User interface

  Created about 2 months ago

  v2.0
  🇫🇷France bedlam

  about 2 months ago
• 🐛

  Insufficient entropy in loginHash generation

  Active

  Code

  Created 4 months ago

  v2.0
  🇺🇸United States cmlara

  about 2 months ago
• 🐛

  ParagonIE\ConstantTime\Encoding dependency not installed from TFA

  Needs review

  Code

  Created 6 months ago

  v1.9
  seeduardo

  2 months ago
• 🌱

  Roadmap for 2.0.0 release

  Active

  Miscellaneous

  Created almost 2 years ago

  v2.0
  🇺🇸United States cmlara

  2 months ago
• 📌

  Use an EventSubscriber to protect one time login links

  Active

  Code

  Created over 1 year ago

  v2.0
  🇺🇸United States cmlara

  2 months ago
• 🐛

  Class 'Base32\Base32' not found - switch library to paragonie/constant_time_encoding

  Fixed

  Code

  Created over 7 years ago

  v1.0
  🇺🇸United States daggerhart

  2 months ago
• 🐛

  Only show default plugin when TFA disabled and hide skip validation attempts if disabled

  Active

  Code

  Created 9 months ago

  v2.0
  🇺🇸United States jsutta

  2 months ago
• 📌

  Can we get a new release?

  Active

  Code

  Created 3 months ago

  v2.0
  🇳🇿New Zealand Gold

  3 months ago
• 🐛

  TFA Pages: Mermaid graphs not loading

  Active

  Documentation

  Created 9 months ago

  v2.0
  🇺🇸United States cmlara

  3 months ago
• 🐛

  TFA gets automatically disabled for all users.

  Active

  Code

  Created 7 months ago

  v1.8
  🇮🇳India lomasr

  3 months ago
• 📌

  TfaPluginManager should use ConfigFactory not ImmutableConfig

  Active

  Code

  Created 4 months ago

  v2.0
  🇺🇸United States cmlara

  3 months ago
• 🐛

  Fix isTfaDisabled

  Active

  Code

  Created 4 months ago

  v1.10
  🇨🇭Switzerland milanbombschliip

  4 months ago
• 💬

  Can we switch site from 2.0.0-apha2 to 8.x-1.7?

  Active

  Documentation

  Created 9 months ago

  v2.0
  🇬🇧United Kingdom arcaic

  4 months ago
• 📌

  Create "Email one-time-code" Validation Plugin & related Setup Plugin

  Needs work

  Code

  Created over 7 years ago

  v2.0
  🇺🇸United States daggerhart

  4 months ago
• 📌

  Cleanup cSpell GitLab Warnings

  Active

  Miscellaneous

  Created 7 months ago

  v2.0
  🇺🇸United States cmlara

  4 months ago
• 📌

  Revert PHPUnit Stage to not use core phpunit.xml

  Active

  User interface

  Created 5 months ago

  v2.0
  🇺🇸United States cmlara

  4 months ago
• ✨

  provide an option to skip sql sanitization for tfa

  Needs work

  Code

  Created about 2 years ago

  v2.0
  🇮🇳India shivamitakari

  4 months ago
• 🐛

  TfaLoginController enforces opaque form expiration

  Active

  Code

  Created almost 2 years ago

  v2.0
  🇩🇪Germany giuspe

  4 months ago
• 🐛

  Deprecations PHP 8.4

  Active

  Code

  Created 6 months ago

  v2.0
  🇮🇳India chandansha

  4 months ago
• ✨

  Support `user.reset` route that can be used by Drush or Simple Pass Reset module

  Needs work

  Code

  Created 5 months ago

  v1.0
  🇰🇬Kyrgyzstan elaman

  5 months ago
• ✨

  TFA only overwrites user.login

  Active

  Code

  Created 5 months ago

  v1.9
  🇳🇱Netherlands makertimswis

  5 months ago
• ✨

  Allow Bypassing Password Confirmation for 2FA Setup for SSO-Authenticated Users

  Needs work

  Code

  Created 5 months ago

  v1.9
  🇮🇳India hardik_patel_12

  5 months ago
• ✨

  Add ECA condition plugin "is TFA setup"

  Active

  Code

  Created over 1 year ago

  v2.0
  🇦🇺Australia sime

  5 months ago
• ✨

  Ignore roles feature

  Needs review

  Code

  Created 5 months ago

  v1.9
  🇲🇩Moldova nick.murza

  5 months ago
• 🐛

  Original page lost after TOTP authentication

  Active

  Code

  Created over 9 years ago

  v2.0
  🇺🇸United States rocketeerbkw

  5 months ago
• 💬

  TFA to confirm action

  Closed: outdated

  Documentation

  Created over 10 years ago

  v2.0
  🇦🇪United Arab Emirates johnkareoke

  5 months ago
• 🐛

  UI feedback ("Login disallowed") can disappear

  Closed: outdated

  Code

  Created almost 10 years ago

  v2.0
  🇳🇱Netherlands eelkeblok

  5 months ago
• 📌

  Make secondary action less prominent on 2nd-factor input form during login

  Closed: outdated

  User interface

  Created almost 10 years ago

  v2.0
  🇺🇸United States sreynen

  5 months ago
• ✨

  Protect only admin paths, without forced logout.

  Closed: outdated

  Code

  Created about 7 years ago

  v2.0
  🇺🇸United States swirt

  5 months ago
• 💬

  Edit emails sent by TFA

  Closed: outdated

  User interface

  Created about 4 years ago

  v2.1
  🇬🇧United Kingdom sksshed

  5 months ago
• 🐛

  Documentation Error

  Closed: outdated

  Documentation

  Created over 9 years ago

  v2.0
  hoopy21

  5 months ago
• 💬

  OAuth2 server support - require TFA for Password Credentials grant type

  Closed: outdated

  Code

  Created about 10 years ago

  v2.0
  🇬🇧United Kingdom pjcdawkins

  5 months ago
• ✨

  Non-unique accounts

  Closed: outdated

  Code

  Created about 6 years ago

  v2.0
  🇳🇱Netherlands edvanleeuwen

  5 months ago
• 📌

  Create a flood limit for a user which blocks that account from logging in with a new browser

  Closed: outdated

  Code

  Created almost 11 years ago

  v2.0
  🇺🇸United States greggles

  5 months ago
• 🐛

  Undefined property error logging out

  Closed: outdated

  Code

  Created almost 5 years ago

  v
  🇳🇱Netherlands edvanleeuwen

  5 months ago
• 💬

  How do I require TFA for new registrations?

  Closed: outdated

  Code

  Created almost 5 years ago

  v2.0
  🇺🇸United States joegl

  5 months ago
• 💬

  User is redirected to TFA page after login even with TFA disabled

  Closed: outdated

  User interface

  Created over 6 years ago

  v2.0
  🇬🇧United Kingdom sksshed

  5 months ago
• ✨

  Preserve form_state of login form for compatibility with other modules

  Closed: outdated

  Code

  Created about 4 years ago

  v2.0
  🇷🇴Romania reszli

  5 months ago
• 💬

  TFA Session expired

  Active

  User interface

  Created almost 2 years ago

  v2.3
  derrick.iverson.dev@gmail.com

  5 months ago
• 🐛

  Self-service password reset not working when tfa is enabled

  Active

  Code

  Created over 6 years ago

  v2.0
  🇺🇸United States anthonyf

  5 months ago
• 📌

  Context alter documentaion missing

  Needs review

  Documentation

  Created over 10 years ago

  v2.0
  🇮🇳India subhojit777

  5 months ago
• 🐛

  Access to TFA page is denied

  Active

  Code

  Created 6 months ago

  v1.9
  🇳🇱Netherlands zebda

  6 months ago
• 📌

  Encourage the use of ssl to avoid replay attacks

  Active

  Documentation

  Created almost 11 years ago

  v2.0
  🇺🇸United States greggles

  6 months ago
• 🐛

  Redirect correctly after first time plugin setup

  Needs review

  Code

  Created 7 months ago

  v2.0
  🇬🇧United Kingdom Dubs

  6 months ago
• 🐛

  Contrib modules can bypass TFA authentication

  Active

  Code

  Created over 1 year ago

  v2.0
  🇺🇸United States cmlara

  6 months ago
• 🌱

  PHP 7.0 Support

  Active

  Code

  Created 6 months ago

  v1.0
  🇺🇸United States cmlara

  6 months ago
• ✨

  Create option to bypass the password check during TFA setup

  Closed: duplicate

  Code

  Created about 7 years ago

  v2.0
  🇺🇸United States swirt

  6 months ago
• ✨

  Allow admins to set up TFA for other users in bulk

  Active

  Code

  Created over 6 years ago

  v2.0
  🇬🇧United Kingdom hoegrammer

  6 months ago
• ✨

  Allow users to setup TFA along with registration

  Active

  Code

  Created about 6 years ago

  v2.0
  🇺🇸United States jadhavdevendra

  6 months ago
• ✨

  Option to require SSL connection to show Recovery codes, or insist on sending them through email instead

  Active

  Code

  Created almost 10 years ago

  v2.0
  Leeteq

  6 months ago
• 💬

  Do you plan to support SMS based TFA validation?

  Closed: works as designed

  Documentation

  Created about 3 years ago

  v1.0
  🇬🇧United Kingdom Syntapse

  6 months ago
• 📌

  Drupal Core Tests now use one time login links instead of user form

  Active

  Code

  Created 9 months ago

  v2.0
  🇺🇸United States cmlara

  6 months ago
• 📌

  Cleanup TfaUserDataTrait phpstan warnings

  Active

  Code

  Created 7 months ago

  v2.0
  🇺🇸United States cmlara

  6 months ago
• ✨

  Add D11 Support

  Active

  Code

  Created about 1 year ago

  v1.0
  🇺🇸United States cmlara

  6 months ago
• 📌

  Use #config_target for the settings form

  Active

  Code

  Created 7 months ago

  v2.0
  🇳🇱Netherlands idebr

  6 months ago
• 🐛

  Admin cannot disable TFA for a user

  Active

  Code

  Created 8 months ago

  v1.0
  🇳🇿New Zealand RoSk0

  7 months ago
• ✨

  Allow modules to skip TFA through a hook

  Active

  Code

  Created about 1 year ago

  v1.0
  🇦🇹Austria jordik

  8 months ago