WordPress / WordPress/two-factor

Hooks to support requesting 2FA for plugins extending `two-factor` core functionality

Open
#644 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Compatibility
Dominant language
PHP
Stars
825
Forks
187
Avg merge
2d 11h
Merged PRs (30d)
17

Description

Is your enhancement related to a problem? Please describe.

There are potential cases of other plugins, or perhaps custom site functionality, where they might want to leverage the two-factor core plugin functionality to trigger a re-auth of a specific users 2FA credentials. One example here would be a site with an expected high traffic event (e.g. Cyber Monday ad, Super Bowl ad) or perhaps becoming a larger target for hacks and improper publishing (e.g. news org during a national election) wherein they want to force someone trying to update or publish new content to go through re-auth via 2FA to ensure that the author and content being updated/published is done so by a properly credentialed user (versus someone who perhaps gained access to someone's machine to try and update/publish nefarious content).

Proposed Solution

Well documented hooks to expose portions of the 2FA auth flow from places within the WP Admin or site front end as well as some sample code snippets feels like a solid option to support this sort of compatibility/extension of the two-factor plugin.

Designs

No response

Describe alternatives you've considered

No response

Please confirm that you have searched existing issues in this repository.

Yes

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No files, tests, or entry points are named. Start by reviewing the two-factor core authentication flow and its existing extension points; done means providing documented hooks for triggering re-authentication from WP Admin or the front end, along with sample code snippets for plugin authors.

Written by the indexing model from the issue text.

Assessment

Tech stack
php, wordpress
Domain
authentication, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.