1
0
mirror of https://github.com/bitwarden/server synced 2026-02-14 07:23:26 +00:00
Commit Graph

19 Commits

Author SHA1 Message Date
Patrick Pimentel
bd36e9ca40 fix(redirect): [PM-30810] Https Redirection for Cloud Users - Looking at payload body and removed header override solution. 2026-02-06 10:53:52 -05:00
Patrick Pimentel
6e5d259cd9 fix(redirect): [PM-30810] Https Redirection for Cloud Users - Fixed to let the mobie client govern the scheme for redirection. 2026-02-03 15:48:21 -05:00
Patrick Pimentel
c289f972b1 fix(redirect): [PM-30810] Https Redirection for Cloud Users - Removed local check so the mobile client can govern the scheme used. 2026-02-02 16:55:54 -05:00
Patrick Pimentel
26fcfef235 fix(redirect): [PM-30810] Https Redirection for Cloud Users - Used reflection instead of change the interface. 2026-01-23 18:04:26 -05:00
Patrick Pimentel
0f3fcd81dd fix(redirect): [PM-30810] Https Redirection for Cloud Users - Rename enum. 2026-01-23 17:59:42 -05:00
Patrick Pimentel
094754b58f fix(redirect): [PM-30810] Https Redirection for Cloud Users - Clarified messaging around how specific clients will build the response as well as added tests. 2026-01-23 17:57:39 -05:00
Patrick Pimentel
dd6c49e214 fix(redirect): [PM-30810] Https Redirection for Cloud Users - Added a client check to only allow mobile to specify the extra property being sent to the duo api when generating the token. 2026-01-23 17:28:17 -05:00
Patrick Pimentel
762d1a7d2f fix(redirect): [PM-26578] Https Redirection for Cloud Users - Added changes to be able to test locally. 2026-01-09 15:23:07 -05:00
Patrick Pimentel
1fec4cb280 fix(redirect): [PM-26578] Https Redirection for Cloud Users - Added deeplink scheme to duo redirect uri. 2026-01-09 15:14:21 -05:00
Kyle Spearrin
02be34159d fix(vuln): Change OTP and Email providers to use time-constant equality operators
Co-authored-by: Todd Martin <106564991+trmartin4@users.noreply.github.com>
2025-10-28 09:51:24 -04:00
Ike
828003f101 [PM-19055] Add OTP Token Provider that is not dependent on the User entity (#6081)
* feat(pm-19055) : 
  - Add generic OTP generator. This OTP generator is not linked to .NET Identity giving us flexibility.
  - Update `OtpTokenProvider` to accept configuration object to keep interface clean.
  - Implement `OtpTokenProvider` in DI as open generic for flexibility.
* test: 100% test coverage for `OtpTokenProvider`
* doc: Added readme for `OtpTokenProvider`
2025-07-17 17:44:20 -04:00
Todd Martin
2f8460f4db feat(OTP): [PM-18612] Change email OTP to six digits
* Change email OTP to 6 digits

* Added comment on base class

* Added tests

* Renamed tests.

* Fixed tests

* Renamed file to match class
2025-07-14 10:23:30 -04:00
Todd Martin
b4c9133d12 feat(otp): Revert [PM-18612] Consolidate all email OTP to use 6 digits
This reverts commit 737f549f82.
2025-07-08 13:59:44 -04:00
Justin Baur
7fb7d6fa56 Add #nullable disable to auth code (#6055) 2025-07-08 10:25:41 -04:00
Todd Martin
737f549f82 feat(otp): [PM-18612] Consolidate all email OTP to use 6 digits
* Change email OTP to 6 digits

* Added comment on base class
2025-07-07 15:52:30 -04:00
Henrik
8bac7f0145 [PM-14476] Avoid multiple lookups in dictionaries (#4973)
* Avoid multiple lookups in dictionaries

* Consistency in fallback to empty CollectionIds

* Readability at the cost of lines changed

* Readability

* Changes after running dotnet format
2025-06-02 11:18:28 -05:00
Ike
3f95513d11 [PM-19029][PM-19203] Addressing UserService tech debt around ITwoFactorIsEnabledQuery (#5754)
* fix : split out the interface from the TwoFactorAuthenticationValidator into separate file.
* fix: replacing IUserService.TwoFactorEnabled with ITwoFactorEnabledQuery
* fix: combined logic for both bulk and single user look ups for TwoFactorIsEnabledQuery.
* fix: return two factor provider enabled on CanGenerate() method.

* tech debt: modfifying MFA providers to call the database less to validate if two factor is enabled. 
* tech debt: removed unused service from AuthenticatorTokenProvider

* doc: added documentation to ITwoFactorProviderUsers
* doc: updated comments for TwoFactorIsEnabled impl

* test: fixing tests for ITwoFactorIsEnabledQuery
* test: updating tests to have correct DI and removing test for automatic email of TOTP.
* test: adding better test coverage
2025-05-09 11:39:57 -04:00
Justin Baur
1228fe51c8 Resolve auth warnings (#5784) 2025-05-08 07:49:16 -04:00
Ike
ab5d4738d6 [PM-8107] Remove Duo v2 from server (#4934)
refactor(TwoFactorAuthentication): Remove references to old Duo SDK version 2 code and replace them with the Duo SDK version 4 supported library DuoUniversal code.

Increased unit test coverage in the Two Factor Authentication code space. We opted to use DI instead of Inheritance for the Duo and OrganizaitonDuo two factor tokens to increase testability, since creating a testing mock of the Duo.Client was non-trivial.

Reviewed-by: @JaredSnider-Bitwarden
2024-11-18 15:58:05 -08:00