Automattic / Automattic/jetpack-force-2fa
Invalidate sessions on cap escalation
Open
- Dominant language
- PHP
- Stars
- 7
- Forks
- 2
- PR merge metrics
- No merged PRs in 30d
Description
When users gain a cap that requires 2fa, we should invalidate all their active sessions if they don't have 2fa enabled.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by tracing where capability escalation is handled and how active sessions and 2FA status are represented. Review any existing authentication, authorization, or session tests before defining the affected flow. Done means users without 2FA lose all active sessions when they gain a capability requiring 2FA, while users who already have 2FA are unaffected.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- authentication, authorization, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100