RocketChat / RocketChat/Rocket.Chat

Reset TOTP / 2FA does not work and hides API error if Administrator uses 2FA

Open
#23,829 3 comments 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
TypeScript
Stars
46.1k
Forks
13.9k
Avg merge
3d 3h
Merged PRs (30d)
130

Description

Description:

As an administrator I want to reset the TOTP for an user. I changed all settings so that I see the following button in the UI:
grafik
I click on it but the user still has there 2FA enabled (and therefor cannot login).

On the Dev tools I see the request PUT https://server.url/api/v1/users.resetTOTP fails with:

{
	"success": false,
	"error": "TOTP Required [totp-required]",
	"errorType": "totp-required",
	"details": {
		"method": "totp",
		"codeGenerated": false,
		"availableMethods": [
			"totp"
		]
	}
}
Steps to reproduce:
  1. Create a user with 2FA enabled
  2. Try to reset the 2FA as an administrator by clicking on the "Reset TOTP" button
  3. No error message or success message but it did not work
Expected behavior:

I get a Prompt to input my 2FA token as an Administrator. And then the user 2FA is reseted.

Actual behavior:

Nothing happens

Server Setup Information:
  • Version of Rocket.Chat Server: 4.1.2
  • Operating System: docker
  • Deployment Method:
  • Number of Running Instances: 1
  • DB Replicaset Oplog:
  • NodeJS Version:
  • MongoDB Version:
Client Setup Information
  • Desktop App or Browser Version: firefox browser
  • Operating System: linux
Additional context
Relevant logs:

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the administrator flow from the Reset TOTP button and inspect the PUT /api/v1/users.resetTOTP request and its displayed response. Trace how the TOTP-required error is handled; done means the administrator is prompted for a 2FA token, the target user's TOTP is reset, and failures are visible.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
api, authentication
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.