RocketChat / RocketChat/Rocket.Chat
Reset TOTP / 2FA does not work and hides API error if Administrator uses 2FA
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 46.1k
- Forks
- 13.9k
- Avg merge
- 3d 3h
- Merged PRs (30d)
- 130
Description
Description:
As an administrator I want to reset the TOTP for an user. I changed all settings so that I see the following button in the UI:

I click on it but the user still has there 2FA enabled (and therefor cannot login).
On the Dev tools I see the request PUT https://server.url/api/v1/users.resetTOTP fails with:
{
"success": false,
"error": "TOTP Required [totp-required]",
"errorType": "totp-required",
"details": {
"method": "totp",
"codeGenerated": false,
"availableMethods": [
"totp"
]
}
}
Steps to reproduce:
- Create a user with 2FA enabled
- Try to reset the 2FA as an administrator by clicking on the "Reset TOTP" button
- No error message or success message but it did not work
Expected behavior:
I get a Prompt to input my 2FA token as an Administrator. And then the user 2FA is reseted.
Actual behavior:
Nothing happens
Server Setup Information:
- Version of Rocket.Chat Server: 4.1.2
- Operating System: docker
- Deployment Method:
- Number of Running Instances: 1
- DB Replicaset Oplog:
- NodeJS Version:
- MongoDB Version:
Client Setup Information
- Desktop App or Browser Version: firefox browser
- Operating System: linux
Additional context
Relevant logs:
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the administrator flow from the Reset TOTP button and inspect the PUT /api/v1/users.resetTOTP request and its displayed response. Trace how the TOTP-required error is handled; done means the administrator is prompted for a 2FA token, the target user's TOTP is reset, and failures are visible.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- api, authentication
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100