Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ecc461fca5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| secret = self._encryptor.decrypt(secret_encrypted) | ||
| verification = verify_totp_code(secret, code, window=1) |
There was a problem hiding this comment.
The replay-protection state (totp_last_verified_step) is only enforced in verify_totp, but disable_totp calls verify_totp_code without passing last_verified_step and does not update it. This means a code that was already used successfully in the same 30‑second time step can be replayed to disable TOTP, undermining the “replay protection” guarantee when the disable endpoint is hit within that window. Consider passing last_verified_step (and updating it) here to block reuse across all TOTP‑gated actions.
Useful? React with 👍 / 👎.
feat: TOTP AUTH FOR WEB PANEL
add SSL support
# Conflicts: # app/dependencies.py # app/main.py # app/static/index.js
- Require X-Codex-LB-Setup-Token for TOTP setup endpoints (fail-closed)\n- Load totpRequiredOnLogin/totpConfigured before saving settings\n- Sync uv.lock for segno
|
This is a great feature! |
|
@all-contributors please add @dwnmf for code, test |
|
I've put up a pull request to add @dwnmf! 🎉 |
- Introduced a new section detailing the setup of TOTP two-factor authentication for the dashboard. - Included steps for setting the setup token and enabling TOTP in the dashboard settings.
Co-authored-by: Cursor <cursoragent@cursor.com>
3 participants
Hello Soju06,
This PR introduces optional TOTP authentication for dashboard access with a compact end-to-end flow.
What’s included
UX improvements
/dashboard.Validation
173 passed, 1 skipped).Thanks for reviewing.