Highlights
sm-mfa-plugin 0.1.2 closes several gaps around second-factor challenges.
Fixed
- A ban or password change ends the user's pending login challenges. Every verify route refuses a banned user, a user suspended at the verifying address, or a user who changed their password after the challenge was created.
- Completing a challenge is all-or-nothing: the spent code, the trusted device and the issued session commit together, so a failure no longer burns a recovery code without signing the user in.
- A wrong password on the recovery-code routes counts as a failed login, so those routes can no longer be used to guess a password past the login throttle.
Changed
- A password change demotes the user's passkeys to second-factor keys, so a passkey added from a stolen session does not outlive the password change. Users who change their password register their passkeys again for password-free sign-in.