dotnet / dotnet/aspnetcore

CheckPasswordSignInCoreAsync in SignInManager doesn't report RequiresTwoFactor

Open
#64,093 4 comments 0 reactions 0 assignees View on GitHub
area-identity Docs
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 10h
Merged PRs (30d)
281

Description

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Describe the bug

In .NET 10 RC2 ( don't know about anywhere else) the SignInManager.cs CheckPasswordSignInCoreAsync returns a SignInResult.

But the code clearly shows that it never actually sets the Two Factor requirement which it should as it does check if it is required it just does nothing with it and returns success.

This means that CheckPasswordSignIn incorrectly says that the password signin would be successful when it wouldn't be, it would return RequiresTwoFactor.

While you can work around this by just directly trying to SignIn (which works) you're not signed in thus defeating the point of having CheckPasswordSignIn.

### Expected Behavior

This should return result.RequiresTwoFactor = true if Two Factor authentication is on.

### Steps To Reproduce

Setup a user that has Two Factor Authentication on (phone or Authenticator app, doesn't matter)
Call signInManager.CheckPasswordSignInAsync

It doesn't have a parameter to tell it to check for Two factor, so just accept the defaults.

IT will always return Success instead of RequiresToFactor

### Exceptions (if any)

_No response_

### .NET Version

10.0.100-rc.2.25502.107

### Anything else?

N/A.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.