unexpected behaviour of accounts/two_factor/setup/ -> page reload after pressing 'verify' about django-allauth-2fa HOT 7 CLOSED

Indeed, syncing the clocks of my TOTP device and my computer solved the problem. Many thanks for your guidance!

from django-allauth-2fa.

My guess would be that the included form isn't working for some reason. Do you do something weird with CSRF tokens? Are you overriding the template?

from django-allauth-2fa.

The only two places where I am using CSRF tokens are in my login.html and logout.html files.

login.html:

{% extends '_base.html' %}
{% load static %}
{% load crispy_forms_tags %}

{% block title %}Login{% endblock title %}

{% block content %}
<div class="card">

    <form method="post">
        {% csrf_token %}
        {{ form|crispy }}
        <div class="form-group mb-0 text-center">
        <button class="btn btn-primary" type="submit">Log In</button>
        </div>
    </form>

</div>
{% endblock content %}

logout.html:

{% extends '_base.html' %}
{% load static %}
{% load crispy_forms_tags %}


{% block content %}
<div class="card-body p-4">
                                
    <div class="text-center w-75 m-auto">
        <h4 class="text-dark-50 text-center mt-3 font-weight-bold">Hi {{ user.email }}!</h4>
        <p class="text-muted mb-4">Are you sure you want to sign out?</p>
    </div>

    <div class="container">
        <form method="post" action="{% url 'account_logout' %}">
            {% csrf_token %}
            {{ form|crispy }}
            <div class="form-group mb-0 text-center">
                <button class="btn btn-danger" type="submit">Log Out</button>
            </div>
        </form>
    </div>
    
</div>
  
{% endblock content %}

from django-allauth-2fa.

I meant the templates that allauth-2fa uses.

Although now that I'm looking at the view again, this most likely occurs if you enter the wrong information. Do the clocks on the computer that is running your Django app and your TOTP devices match?

from django-allauth-2fa.

My computer is 1min 25 sec behind my TOTP device (iPhone). But could this be the issue? It might always be the case that the TOTP device of at least one of the users of the app is slighty off compared to the time of the server.

I also tried to set the TIME_ZONE in my settings.py from 'UTC' to 'Europe/Vienna' but it did not solve the issue

from django-allauth-2fa.

My computer is 1min 25 sec behind my TOTP device (iPhone). But could this be the issue?

Yes, TOTP codes are valid for 30 seconds only.

It seems like django-otp has some configuration options for this though: https://github.com/django-otp/django-otp/blob/master/docs/source/overview.rst#totp-devices

from django-allauth-2fa.

Seems like we should be showing an error on the form if the TOTP code is wrong though. 😢

from django-allauth-2fa.