Either Password or 2FA for accessing Webhook Auth info, not both
Nobody has claimed this yet.
- Dominant language
- Elixir
- Stars
- 296
- Forks
- 86
- Avg merge
- 1d 13h
- Merged PRs (30d)
- 50
Description
For security purposes, we require a user to add their username and password when viewing the password or API key for the Webhook authentication method.
Currently (see screenshot attached), the user has the option of selecting either the password or 2FA code to view it, which is incorrect:
- If 2FA is not enabled for user: Request Password
- If 2FA is enabled for user: Request 2FA code
This adheres to the users security preference of having 2FA enabled.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at the Webhook authentication method's flow for viewing its password or API key, and trace how the password and 2FA choices are presented. Verify the behavior for users with 2FA disabled and enabled, ensuring each case requests only the corresponding security factor.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- elixir
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100