Skip to content

fix: validate MFA claim before allowing TOTP device removal #579

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
namsnath merged 1 commit into from
Apr 11, 2025
Merged

fix: validate MFA claim before allowing TOTP device removal #579

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

## [unreleased]

## [0.29.1] - 2025-04-11
- Fixes an issue where `removeDevice` API allowed removing TOTP devices without the user completing MFA.

## [0.29.0] - 2025-03-03
### Breaking changes
- Makes URL path normalization case sensitive
Expand Down
2 changes: 1 addition & 1 deletion setup.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,7 +82,7 @@

setup(
name="supertokens_python",
version="0.29.0",
version="0.29.1",
author="SuperTokens",
license="Apache 2.0",
author_email="[email protected]",
Expand Down
2 changes: 1 addition & 1 deletion supertokens_python/constants.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@
from __future__ import annotations

SUPPORTED_CDI_VERSIONS = ["5.2"]
VERSION = "0.29.0"
VERSION = "0.29.1"
TELEMETRY = "/telemetry"
USER_COUNT = "/users/count"
USER_DELETE = "/user/remove"
Expand Down
4 changes: 3 additions & 1 deletion supertokens_python/recipe/totp/api/remove_device.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,9 @@ async def handle_remove_device_api(

session = await get_session(
api_options.request,
override_global_claim_validators=lambda _, __, ___: [],
override_global_claim_validators=lambda global_claim_validators, __, ___: [
gcv for gcv in global_claim_validators if gcv.id == "st-mfa"
],
session_required=True,
user_context=user_context,
)
Expand Down
4 changes: 4 additions & 0 deletions tests/test-server/test_functions_mapper.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -142,6 +142,10 @@ async def get_mfa_requirements_for_auth(
required_secondary_factors_for_tenant: Any,
user_context: Dict[str, Any],
) -> MFARequirementList:
# Test specifies an override, return the required data
if 'getMFARequirementsForAuth:async()=>["totp"]' in eval_str:
return ["totp"]

return ["otp-phone"] if user_context.get("requireFactor") else []

original_implementation.get_mfa_requirements_for_auth = (
Expand Down