Unable to login after setting up 2FA about django-allauth-2fa HOT 6 CLOSED

Hey @9mido,

Here is an example of what it looks like as far as I remember.

middleware.py

WHITELISTED_PATHS = [
"/api",
"/assets",
"/js",
"/css"
{...other paths that you load when logging in}
]

class TwoFactorMiddleware(AllauthTwoFactorMiddleware):
    def process_request(self, request):
        permit_request = any(request.path.startswith(path) for path in WHITELISTED_PATHS)
        if permit_request:
            return

        super(TwoFactorMiddleware, self).process_request(request)

Something like this should work. Just use default allauth_2fa URLs, and include this middleware class on your middleware list.

To get the list of all whitelisted paths, disable the 2FA temporarily, and while logging in check your network tab on the console.

from django-allauth-2fa.

Hey @9mido,
Completely guessing, as I am not sure what your actual code looks like, but all the allauth_2fa URLs do need a trailing slash for it to work, E.g. */two-factor-authenticate/.

If you are being redirected back to the login page when using a trailing slash, I believe you have something interrupting your login flow. allauth_2fa will point you back to the login page if anything interrupts the login flow, it could be any CSS/js file or any network request.

Read more on this file: django-allauth-2fa/allauth_2fa/middleware.py

class AllauthTwoFactorMiddleware(MiddlewareMixin):
    """
    Reset the login flow if another page is loaded halfway through the login.
    (I.e. if the user has logged in with a username/password, but not yet
    entered their two-factor credentials.) This makes sure a user does not stay
    half logged in by mistake.
    """

    def process_request(self, request):
        match = resolve(request.path)
        if not match.url_name or not match.url_name.startswith(
                'two-factor-authenticate'):
            try:
                del request.session['allauth_2fa_user_id']
            except KeyError:
                pass

To fix the issue I had to write a middleware function on top of the AllauthTwoFactorMiddleware class passing a list of allowed PATHS.

Let me know if this is the case.

from django-allauth-2fa.

@9mido What versions of Django and django-allauth-2fa and django-allauth?

It looks to me like the URL config has a slash on the end in the URLs file, but I'm unsure if that matters here.

I believe the error page shows you all the registered URL patterns? You might need to install django-debug-toolbar to do that though... I'd expect it to show up properly though if you were able to configure two-factor.

from django-allauth-2fa.

I am using the latest versions of Django, django-allauth-2fa, django-allauth, and python 3.7.3.

Yea for some reason when I tried it, the slash did not show up at the end of /two-factor-authenticate.

Here is a video:

https://streamable.com/21xff

When I add a slash to the end of /two-factor-authenticate the debugger brings me to /accounts/login/ and I am unable to login from there. However.. I am able to get to /two-factor-authenticate/ successfully only if I login from /accounts/login/ but then from the debugger instead of clicking /two-factor-authenticate from the 302 page.. if I manually type in /two-factor-authenticate/ into the URL then I can get to the page where you enter the token.

See this video:

https://streamable.com/jijfg

from django-allauth-2fa.

@sabipu

Thanks for the reply. That is a really good analysis. Can you share your middleware function and urls.py paths that you wrote on top of the AllauthTwoFactorMiddleware class? I want to try your code and see if that makes a difference.

If I am still having problems after that, I will share my code and we could analyze it further.

from django-allauth-2fa.

@sabipu Thanks for the help. I tried everything out on a fresh install of django-allauth and django-allauth-2fa and there does not seem to be a problem anymore. There must have been a problem that was self caused when I was a beginner in django programming. Now that I am more experienced, there does not seem to be a problem anymore. I will close this issue for now but if I see it again when implementing it with my main code I will re-open this issue again.

from django-allauth-2fa.