Blog
FAQ
Discussions
Search
Projects, issues, users, and merge requests.
Project ID, name, and description.
User nickname, name, and org.
Issue ID, title, and summary.
Merge request titles.
Contrib
.social
Feed
Live feed
Builds
Live builds
Core
Tags
Tags and Initiatives
Two-factor Authentication (TFA)
Open on Drupal.org →
Open on Drupal GitLab →
Created on 21 March 2011,
about 14 years ago
Maintained by
🇺🇸
United States
coltrane
🇺🇸
United States
daggerhart
🇺🇸
United States
greggles
🇵🇹
Portugal
jcnventura
🇺🇸
United States
nerdstein
Clone
Clone with SSH
Clone with HTTPS
Clone with
doGit
🇺🇸
United States
61%
🇬🇧
United Kingdom
8%
🇮🇳
India
5%
🏴☠️
3%
🇳🇿
New Zealand
3%
🇵🇹
Portugal
3%
🇩🇪
Germany
2%
🇮🇱
Israel
2%
🇦🇺
Australia
2%
🇰🇬
Kyrgyzstan
2%
🇭🇺
Hungary
1%
🇲🇩
Moldova
1%
🇧🇾
Belarus
1%
🏴☠️
🇨🇦 🇳🇱 🇯🇵 🇸🇰 🇪🇸 🇷🇺 🇨🇭 🇧🇪 🇮🇹
5%
Top 10 contributors
DM13 Security LLC
56%
🇺🇸
@cmlara
Soapbox Communications Ltd
4%
🇬🇧
@scott_euser
Cyber-Duck
3%
🇬🇧
@Alina Basarabeanu
@seeduardo
🇬🇧
@arcaic
IT.NRW
2%
🇩🇪
@lmoeni
ComputerMinds
2%
🇬🇧
@steven jones
🇬🇧
@james.williams
🇬🇧
@ChristianSanders
Innoraft
2%
🇮🇳
@kalash-j
🇮🇳
@sayan_k_dutta
🇮🇳
@arunsahijpal
CivicActions
1%
🇺🇸
@dmundra
🇺🇸
@swirt
Ackama
1%
🇳🇿
@Gold
T-Systems Multimedia Solutions GmbH
1%
🇭🇺
@imre.horjan
Indrivo
1%
🇲🇩
@nick.murza
+38
and 38 other organisations
Wipro Technologies
🇮🇳
@sksanjoo2
cmsMinds
🇮🇳
@chandansha
Your Dev Team
🇧🇾
@gun_dose
Drupology
🇬🇧
@Dubs
Axelerant
🇮🇳
@hardik_patel_12
Catalyst IT
🇳🇿
@RoSk0
Department of Premier and Cabinet - Victoria, Australia
🇦🇺
@Nadim Hossain
Sparks Interactive
🇳🇿
@chroid
PreviousNext
🇦🇺
@larowlan
🇦🇺
@acbramley
Morpht
@naveenvalecha
ActivIT s.r.o.
🇸🇰
@poker10
Zebralog
🇩🇪
@ammaletu
Textillia
🇨🇦
@brunodbo
Alloy Magnetic
🇺🇸
@delzhand
ezCompany
🇳🇱
@idebr
Cambrico
🇪🇸
@pcambra
Skilld
🇷🇺
@sorlov
Pivale
🇬🇧
@d.fisher
Liip
🇨🇭
@milanbombschliip
Acquia
🇮🇳
@ankitv18
Blue Oak Interactive
🇺🇸
@andyg5000
SystemSeed
🇧🇾
@beloglazov91
Tag1 Consulting
🇪🇸
@pcambra
🇮🇹
@plach
Atom
🇳🇱
@SanderJP
Affinity Digital Tech Ltd
🇬🇧
@somersoft
Salsa Digital
🇦🇺
@Toby Wild
Abt Associates
🇺🇸
@beunerd
NTT DATA
🇵🇹
@tmiguelv
SWIS
🇳🇱
@makertimswis
iO
🇧🇪
@baikho
🇳🇱
@idebr
National Science Foundation
🇺🇸
@dmundra
Centers for Medicare and Medicaid Services
🇺🇸
@dmundra
🇺🇸
@swirt
Google Summer of Code
@naveenvalecha
Google Code-In
@naveenvalecha
Ymbra
🇪🇸
@pcambra
AED
🇪🇸
@pcambra
Drupal.cat
🇪🇸
@pcambra
Somersoft
🇬🇧
@somersoft
and 11 individuals
( 12% )
🇬🇧
@aaron.ferris
🇺🇸
@greggles
🇵🇹
@jcnventura
🇮🇱
@jkdev
🇺🇸
@mortona2k
🇰🇬
@elaman
🇯🇵
@ptmkenny
🇮🇳
@bhanu951
🇺🇸
@jsutta
🇨🇦
@tame4tex
@project update bot
Follow
Sign in to follow projects
Merge Requests
More
!135
plugin_label missing in feedback when TFA setup is canceled
Open
Show issue
🇬🇧
United Kingdom
aaron.ferris
updated
1 day ago
!143
Allowing authenticated users access to setup adds misleading message to config form
Open
Show issue
🇬🇧
United Kingdom
scott_euser
updated
3 days ago
!142
Remove referneces to Twillo Authy desktop apps
Merged
Show issue
🇺🇸
United States
cmlara
updated
3 days ago
!141
Increase minimum requierments for 2.x branch
Open
Show issue
🇺🇸
United States
cmlara
updated
4 days ago
!140
Convert plugins to use PHP Attributes only.
Open
Show issue
🇺🇸
United States
cmlara
updated
5 days ago
!138
Invalid application code if time is out of sync on server and client
Merged
Show issue
🇺🇸
United States
cmlara
updated
7 days ago
More Merge Requests
Issues
✨
Tugboat previews
Active
Code
Created
2 months ago
v2.0
🇺🇸
United States
dmundra
1 day ago
🐛
plugin_label missing in feedback when TFA setup is canceled
Active
Code
Created
8 months ago
v1.9
🇩🇪
Germany
lmoeni
1 day ago
✨
QR code difficult to see on dark mode themes
Active
User interface
Created
10 months ago
v1.0
🇳🇿
New Zealand
chroid
1 day ago
🐛
Allowing authenticated users access to setup adds misleading message to config form
Active
User interface
Created
3 days ago
v2.0
🇬🇧
United Kingdom
scott_euser
2 days ago
✨
Option to disable TFA when requesting new password
Active
Code
Created
3 days ago
v2.0
🇳🇱
Netherlands
edvanleeuwen
2 days ago
✨
Document how to use TFA with REST
Active
Code
Created
about 1 month ago
v2.0
🇬🇧
United Kingdom
scott_euser
3 days ago
✨
Make QR account name configurable
Active
User interface
Created
almost 7 years ago
v2.0
🇧🇪
Belgium
JeroenT
3 days ago
🐛
Issuer field not configured
Active
Code
Created
over 1 year ago
v1.2
🇫🇷
France
slayne40
3 days ago
📌
Remove referneces to Twillo Authy desktop apps
Active
Code
Created
over 1 year ago
v2.0
🇺🇸
United States
cmlara
3 days ago
📌
Increase minimum requierments for 2.x branch
Active
Code
Created
5 days ago
v2.0
🇺🇸
United States
cmlara
4 days ago
✨
User account should be marked as updated when TFA is updated
Active
Code
Created
almost 9 years ago
v2.0
🇨🇦
Canada
cdeces
4 days ago
📌
Fix composer deprecation warning
Active
Code
Created
about 1 month ago
v2.0
🇬🇧
United Kingdom
scott_euser
5 days ago
📌
Convert plugins to use PHP Attributes only.
Active
Code
Created
over 1 year ago
v2.0
🇺🇸
United States
cmlara
5 days ago
📌
Support chillerlan/php-qrcode 5.x
Active
Code
Created
5 days ago
v2.0
🇺🇸
United States
mortona2k
5 days ago
🐛
Change heading hierarchy for accessibility purposes
Active
Code
Created
8 months ago
v1.9
🇩🇪
Germany
lmoeni
7 days ago
📌
Invalid application code if time is out of sync on server and client
Active
Documentation
Created
over 7 years ago
v2.0
yfaouzi
7 days ago
📌
Evaluate restoring using a form alter instead of extending UserLoginForm
Active
Code
Created
over 1 year ago
v2.0
🇺🇸
United States
cmlara
7 days ago
🐛
Resolve SA-CONTRIB-2024-003 in 2.x branch
Postponed
Code
Created
over 1 year ago
v2.0
🇺🇸
United States
cmlara
7 days ago
📌
Cleanup PHPStan Baseline
Active
Code
Created
about 2 months ago
v1.0
🇺🇸
United States
cmlara
7 days ago
📌
Fix install instruction on project-page
Active
Documentation
Created
over 1 year ago
v1.0
🇳🇱
Netherlands
joshahubbers
7 days ago
📌
Remove usage of alreadyAcceptedCode()/storeAccepedCode() in the TOTP,HOTP, Recovery Code plugins.
Active
Code
Created
over 1 year ago
v2.0
🇺🇸
United States
cmlara
7 days ago
🐛
TfaSetupForm overrides form_state storage
Active
Code
Created
about 3 years ago
v2.0
🇺🇸
United States
cmlara
9 days ago
✨
Add client IP address as criteria for invalidating TFA
Active
User interface
Created
over 2 years ago
v2.0
🇺🇸
United States
damienmckenna
9 days ago
🐛
Full Setup not working on 8.x-1.7
Active
Code
Created
about 1 year ago
v1.7
marcellinostroosnijder
10 days ago
🐛
TFA enabled config not set on user profile
Active
Code
Created
almost 2 years ago
v2.0
🇬🇧
United Kingdom
xiwar
11 days ago
📌
Incorrect typehint \Drupal\encrypt\EncryptionProfileInterface
Needs review
Code
Created
about 1 year ago
v1.0
🇺🇸
United States
andyg5000
11 days ago
🐛
The "skip step"/"skip and finish" button UX is confusing because the error "TFA setup canceled" is then shown when clicked
Active
User interface
Created
about 1 year ago
v1.0
🇬🇧
United Kingdom
alexharries
11 days ago
✨
Invalidate other sessions when a user enables TFA
Active
Code
Created
over 5 years ago
v2.0
🇬🇧
United Kingdom
mcdruid
11 days ago
💬
Migration from Drupal 7 to Drupal 9
Active
Miscellaneous
Created
over 2 years ago
v1.0
🇺🇸
United States
jsutta
11 days ago
📌
Disable Cache
Closed: cannot reproduce
Code
Created
almost 6 years ago
v2.0
🇪🇬
Egypt
ahmed-ayman
11 days ago
🐛
404 on user password form after being forced to set up TFA with 0 attempts left
Closed: works as designed
Code
Created
over 7 years ago
v2.0
🇺🇸
United States
ryan.ryan
12 days ago
🐛
Implement Drupal\user\UserAuthenticationInterface
Needs review
Code
Created
5 months ago
v2.0
🇭🇺
Hungary
imre.horjan
14 days ago
🐛
Redirect to TFA doesn't work with login destination modules
Active
Code
Created
7 months ago
v1.9
🇧🇾
Belarus
gun_dose
18 days ago
🐛
One setup step remaining, two QR Code Scans required
Active
User interface
Created
8 months ago
v1.8
🇺🇸
United States
cmarcera
20 days ago
🐛
TFA setup not fully accessible
Active
User interface
Created
about 1 month ago
v2.0
🇫🇷
France
bedlam
about 1 month ago
🐛
Insufficient entropy in loginHash generation
Active
Code
Created
3 months ago
v2.0
🇺🇸
United States
cmlara
about 1 month ago
🐛
ParagonIE\ConstantTime\Encoding dependency not installed from TFA
Needs review
Code
Created
5 months ago
v1.9
seeduardo
about 1 month ago
🌱
Roadmap for 2.0.0 release
Active
Miscellaneous
Created
almost 2 years ago
v2.0
🇺🇸
United States
cmlara
about 1 month ago
🐛
Password reset not working
Active
Code
Created
about 1 year ago
v1.7
🇳🇱
Netherlands
zebda
about 1 month ago
✨
Login plugin to skip TFA from trusted IP addresses
Needs work
Code
Created
almost 6 years ago
v2.0
🇳🇱
Netherlands
e.ruiter
about 1 month ago
📌
Use an EventSubscriber to protect one time login links
Active
Code
Created
over 1 year ago
v2.0
🇺🇸
United States
cmlara
about 1 month ago
🐛
Class 'Base32\Base32' not found - switch library to paragonie/constant_time_encoding
Fixed
Code
Created
over 7 years ago
v1.0
🇺🇸
United States
daggerhart
about 2 months ago
🐛
Only show default plugin when TFA disabled and hide skip validation attempts if disabled
Active
Code
Created
8 months ago
v2.0
🇺🇸
United States
jsutta
about 2 months ago
📌
Can we get a new release?
Active
Code
Created
about 2 months ago
v2.0
🇳🇿
New Zealand
Gold
about 2 months ago
🐛
TFA Pages: Mermaid graphs not loading
Active
Documentation
Created
8 months ago
v2.0
🇺🇸
United States
cmlara
about 2 months ago
🐛
TFA gets automatically disabled for all users.
Active
Code
Created
6 months ago
v1.8
🇮🇳
India
lomasr
2 months ago
📌
TfaPluginManager should use ConfigFactory not ImmutableConfig
Active
Code
Created
3 months ago
v2.0
🇺🇸
United States
cmlara
2 months ago
📌
Public followup for SA-CONTRIB-2025-023
Active
Code
Created
3 months ago
v1.0
🇺🇸
United States
cmlara
3 months ago
🐛
Fix isTfaDisabled
Active
Code
Created
3 months ago
v1.10
🇨🇭
Switzerland
milanbombschliip
3 months ago
💬
Can we switch site from 2.0.0-apha2 to 8.x-1.7?
Active
Documentation
Created
8 months ago
v2.0
🇬🇧
United Kingdom
arcaic
3 months ago
🐛
Compatibility with Drush 13
Active
Code
Created
3 months ago
v1.9
🇷🇸
Serbia
ratvas
3 months ago
📌
Create "Email one-time-code" Validation Plugin & related Setup Plugin
Needs work
Code
Created
over 7 years ago
v2.0
🇺🇸
United States
daggerhart
3 months ago
📌
Cleanup cSpell GitLab Warnings
Active
Miscellaneous
Created
6 months ago
v2.0
🇺🇸
United States
cmlara
3 months ago
📌
Revert PHPUnit Stage to not use core phpunit.xml
Active
User interface
Created
4 months ago
v2.0
🇺🇸
United States
cmlara
3 months ago
✨
provide an option to skip sql sanitization for tfa
Needs work
Code
Created
about 2 years ago
v2.0
🇮🇳
India
shivamitakari
4 months ago
🐛
TfaLoginController enforces opaque form expiration
Active
Code
Created
over 1 year ago
v2.0
🇩🇪
Germany
giuspe
4 months ago
🐛
Deprecations PHP 8.4
Active
Code
Created
5 months ago
v2.0
🇮🇳
India
chandansha
4 months ago
✨
Support `user.reset` route that can be used by Drush or Simple Pass Reset module
Needs work
Code
Created
4 months ago
v1.0
🇰🇬
Kyrgyzstan
elaman
4 months ago
✨
TFA only overwrites user.login
Active
Code
Created
4 months ago
v1.9
🇳🇱
Netherlands
makertimswis
4 months ago
📌
Public followup for SA-CONTRIB-2024-043
Postponed
Code
Created
8 months ago
v2.0
🇺🇸
United States
cmlara
4 months ago
✨
Allow Bypassing Password Confirmation for 2FA Setup for SSO-Authenticated Users
Needs work
Code
Created
4 months ago
v1.9
🇮🇳
India
hardik_patel_12
4 months ago
✨
Add ECA condition plugin "is TFA setup"
Active
Code
Created
over 1 year ago
v2.0
🇦🇺
Australia
sime
4 months ago
✨
Ignore roles feature
Needs review
Code
Created
4 months ago
v1.9
🇲🇩
Moldova
nick.murza
4 months ago
🐛
Original page lost after TOTP authentication
Active
Code
Created
over 9 years ago
v2.0
🇺🇸
United States
rocketeerbkw
5 months ago
💬
TFA to confirm action
Closed: outdated
Documentation
Created
over 10 years ago
v2.0
🇦🇪
United Arab Emirates
johnkareoke
5 months ago
🐛
UI feedback ("Login disallowed") can disappear
Closed: outdated
Code
Created
over 9 years ago
v2.0
🇳🇱
Netherlands
eelkeblok
5 months ago
📌
Make secondary action less prominent on 2nd-factor input form during login
Closed: outdated
User interface
Created
almost 10 years ago
v2.0
🇺🇸
United States
sreynen
5 months ago
✨
Protect only admin paths, without forced logout.
Closed: outdated
Code
Created
almost 7 years ago
v2.0
🇺🇸
United States
swirt
5 months ago
💬
Edit emails sent by TFA
Closed: outdated
User interface
Created
about 4 years ago
v2.1
🇬🇧
United Kingdom
sksshed
5 months ago
🐛
Documentation Error
Closed: outdated
Documentation
Created
over 9 years ago
v2.0
hoopy21
5 months ago
💬
OAuth2 server support - require TFA for Password Credentials grant type
Closed: outdated
Code
Created
about 10 years ago
v2.0
🇬🇧
United Kingdom
pjcdawkins
5 months ago
✨
Non-unique accounts
Closed: outdated
Code
Created
about 6 years ago
v2.0
🇳🇱
Netherlands
edvanleeuwen
5 months ago
📌
Create a flood limit for a user which blocks that account from logging in with a new browser
Closed: outdated
Code
Created
almost 11 years ago
v2.0
🇺🇸
United States
greggles
5 months ago
🐛
Undefined property error logging out
Closed: outdated
Code
Created
almost 5 years ago
v
🇳🇱
Netherlands
edvanleeuwen
5 months ago
💬
How do I require TFA for new registrations?
Closed: outdated
Code
Created
almost 5 years ago
v2.0
🇺🇸
United States
joegl
5 months ago
💬
User is redirected to TFA page after login even with TFA disabled
Closed: outdated
User interface
Created
over 6 years ago
v2.0
🇬🇧
United Kingdom
sksshed
5 months ago
✨
Preserve form_state of login form for compatibility with other modules
Closed: outdated
Code
Created
almost 4 years ago
v2.0
🇷🇴
Romania
reszli
5 months ago
💬
TFA Session expired
Active
User interface
Created
almost 2 years ago
v2.3
derrick.iverson.dev@gmail.com
5 months ago
🐛
Self-service password reset not working when tfa is enabled
Active
Code
Created
over 6 years ago
v2.0
🇺🇸
United States
anthonyf
5 months ago
📌
Context alter documentaion missing
Needs review
Documentation
Created
over 10 years ago
v2.0
🇮🇳
India
subhojit777
5 months ago
🐛
Access to TFA page is denied
Active
Code
Created
5 months ago
v1.9
🇳🇱
Netherlands
zebda
5 months ago
📌
Encourage the use of ssl to avoid replay attacks
Active
Documentation
Created
almost 11 years ago
v2.0
🇺🇸
United States
greggles
5 months ago
🐛
Redirect correctly after first time plugin setup
Needs review
Code
Created
7 months ago
v2.0
🇬🇧
United Kingdom
Dubs
5 months ago
🐛
Contrib modules can bypass TFA authentication
Active
Code
Created
over 1 year ago
v2.0
🇺🇸
United States
cmlara
5 months ago
🌱
PHP 7.0 Support
Active
Code
Created
5 months ago
v1.0
🇺🇸
United States
cmlara
5 months ago
✨
Create option to bypass the password check during TFA setup
Closed: duplicate
Code
Created
almost 7 years ago
v2.0
🇺🇸
United States
swirt
6 months ago
✨
Allow admins to set up TFA for other users in bulk
Active
Code
Created
over 6 years ago
v2.0
🇬🇧
United Kingdom
hoegrammer
6 months ago
✨
Allow users to setup TFA along with registration
Active
Code
Created
about 6 years ago
v2.0
🇺🇸
United States
jadhavdevendra
6 months ago
✨
Option to require SSL connection to show Recovery codes, or insist on sending them through email instead
Active
Code
Created
almost 10 years ago
v2.0
Leeteq
6 months ago
💬
Do you plan to support SMS based TFA validation?
Closed: works as designed
Documentation
Created
almost 3 years ago
v1.0
🇬🇧
United Kingdom
Syntapse
6 months ago
📌
Drupal Core Tests now use one time login links instead of user form
Active
Code
Created
8 months ago
v2.0
🇺🇸
United States
cmlara
6 months ago
📌
Cleanup TfaUserDataTrait phpstan warnings
Active
Code
Created
6 months ago
v2.0
🇺🇸
United States
cmlara
6 months ago
✨
Add D11 Support
Active
Code
Created
about 1 year ago
v1.0
🇺🇸
United States
cmlara
6 months ago
📌
Use #config_target for the settings form
Active
Code
Created
6 months ago
v2.0
🇳🇱
Netherlands
idebr
6 months ago
🐛
Admin cannot disable TFA for a user
Active
Code
Created
7 months ago
v1.0
🇳🇿
New Zealand
RoSk0
6 months ago
✨
Allow modules to skip TFA through a hook
Active
Code
Created
about 1 year ago
v1.0
🇦🇹
Austria
jordik
7 months ago
🐛
You are not authorized to access this page on remote only
Active
User interface
Created
about 1 year ago
v1.7
🇳🇱
Netherlands
zebda
7 months ago
📌
Add a Views filter for the 'TFA enabled' field
Active
Code
Created
over 5 years ago
v2.0
🇳🇱
Netherlands
idebr
7 months ago
💬
Get boolean if TFA is set?
Closed: outdated
Code
Created
about 6 years ago
v
🇧🇬
Bulgaria
JustViktor
8 months ago
📌
Automated Drupal 11 compatibility fixes for tfa
Needs review
Code
Created
11 months ago
v1.0
project update bot
8 months ago
contrib
.social
Blog
FAQ
Discussions
Production build 0.71.5
2024