getsentry / getsentry/sentry

2FA Recovery Codes not showing when setting a second method.

Open
#111,992 3 comments 0 reactions 0 assignees View on GitHub
Improvement Product Area: Sign In
Dominant language
Python
Stars
44.8k
Forks
4.9k
Avg merge
21h 10m
Merged PRs (30d)
635

Description

### Problem Statement

Users expect to have 2FA recovery codes automatically presented to them when setting up a 2FA method. Sentry does that when setting up 2FA for the first time in the account.

When setting a second method, for example, first setting up an authenticator app and some time later setting up a passkey, the recovery codes are not shown. This can cause confusion and bad UX when they are not presented with the codes.

Many services also show the codes only once (same as sentry does with auth tokens), which makes the situation worse.

### Solution Brainstorm

A simple solution would be to show the codes every time a new 2FA method is added, which also serve as a reminder to users to have them.

### Product Area

Unknown

Contributor guide

Open the contributing guide

Research direction

No files or tests are named. Start by tracing the existing first-method 2FA setup flow that presents recovery codes, then compare it with the second-method flow; done means adding the same recovery-code presentation when another 2FA method is configured and covering the behavior with tests.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
authentication, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.