Skip to content

Fix: Pass auth headers in 2FA and recovery redirects #19223

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
LiwaaCoder wants to merge 4 commits into from
Closed

Fix: Pass auth headers in 2FA and recovery redirects #19223

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
2d2e870
Fix: Pass auth headers in 2FA and recovery redirects
LiwaaCoder Dec 25, 2025
cbad9fa
chore: update translations
LiwaaCoder Dec 30, 2025
f400276
Fix linting
LiwaaCoder Jan 5, 2026
d329b34
Merge branch 'main' into fix/2fa-session-headers
LiwaaCoder Jan 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 5 additions & 20 deletions package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

12 changes: 8 additions & 4 deletions warehouse/accounts/views.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -414,10 +414,12 @@ def two_factor_and_totp_validate(request, _form_class=TOTPAuthenticationForm):
# We've seen this device before for this user and they've
# confirmed it, log in the user
two_factor_method = "totp"
_login_user(request, userid, two_factor_method, two_factor_label="totp")
headers = _login_user(
request, userid, two_factor_method, two_factor_label="totp"
)
user_service.update_user(userid, last_totp_value=form.totp_value.data)

resp = HTTPSeeOther(redirect_to)
resp = HTTPSeeOther(redirect_to, headers=dict(headers))
_set_userid_insecure_cookie(resp, userid)

if not two_factor_state.get("has_recovery_codes", False):
Expand Down Expand Up @@ -618,7 +620,9 @@ def recovery_code(request, _form_class=RecoveryCodeAuthenticationForm):
if user_service.device_is_known(userid, request):
# We've seen this device before for this user and they've
# confirmed it, log in the user
_login_user(request, userid, two_factor_method="recovery-code")
headers = _login_user(
request, userid, two_factor_method="recovery-code"
)

user = user_service.get_user(userid)
user.record_event(
Expand All @@ -634,7 +638,7 @@ def recovery_code(request, _form_class=RecoveryCodeAuthenticationForm):
queue="success",
)

resp = HTTPSeeOther(redirect_to)
resp = HTTPSeeOther(redirect_to, headers=dict(headers))
_set_userid_insecure_cookie(resp, userid)

return resp
Expand Down
Loading