Prevent MFA factor hijacking

Open
#1,615 3 comments 1 reaction 1 assignee View on GitHub

@J0 is already working on this.

Since Jun 16, 2024.

Assessment

This issue has not been assessed yet.

Description

bug

Bug report / security issue

  • I confirm this is a bug with Supabase, not with my own application.
  • I confirm I have searched the Docs, GitHub Discussions, and Discord.

Describe the bug

Currently, a new MFA can be enrolled at any time after AAL2 has been reached. Which leaves the door open to potential account hijackings if one gains access to a session ( / open browser tab) – just add a new factor and delete the old one.

It's generally a good practice to require re-verification of the 2nd factor close to making dangerous changes to the account from security POV.

I wish this was configurable in user land though, as it may be difficult to come up with a solid middle ground for all use cases here. What would be great is if GoTrue would set the request.jwt.claims current_setting with all its (authenticated) requests, similar to PostgREST, so developers could create custom triggers to customize the logic (e.g. raise an exception if the AMR claim ts is older than x seconds when DELETE'ing from auth.mfa_factors). This would open up a myriad of other use cases as well (we have at least 5 other use cases off the top of my head where we now have had to resort to contrived backend code and re-creating JWTs to add custom logic).

To Reproduce

  1. Enroll an MFA
  2. Leave your session open in a public computer
  3. Someone can enroll their own factor and unenroll yours, effectively locking you out of your account

Expected behavior

Re-verification of the 2nd factor should be required if x-amount of time has passed from initial verification.

Dominant language
Go
Stars
2.6k
Forks
764
Avg merge
5d 3h
Merged PRs (30d)
39

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from supabase/auth

All issues in supabase/auth

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.