added filter to control whether authcode autosubmits by eric-michel · Pull Request #741 · WordPress/two-factor

eric-michel · 2025-12-18T21:14:10Z

What?

Adds a filter to allow a theme or plugin to turn off auto submission of authcodes

Why?

Plugins that enhance two-factor may want to turn off auto-submission to allow the user time to interact with other form elements on the page prior to submission. See #723.

How?

A filter is added and assigned to a variable. That variable is checked prior to the relevant JS being output (and prevents it from printing entirely if the value is false).

Testing Instructions

Install the branch and activate plugin
Verify normal auto-submission experience
In theme's functions.php, add the following:

add_filter( 'two_factor_auto_submit_authcode', '__return_false' );

Observe that the authcode form no longer auto-submits.

Changelog Entry

Added - Themes and plugins can now disable auto-submission of authcodes via the two_factor_auto_submit_authcode filter

kasparsd

This looks good! Had one optional suggestion for moving the PHP state into JS variable to help move these scripts into standalone JS eventually.

Could you please document the filter, add the docblock comment (similar to other filters)?

kasparsd · 2025-12-22T10:20:47Z

class-two-factor-core.php

-								if ( undefined !== form.requestSubmit ) {
-									form.requestSubmit();
-									form.submit.disabled = "disabled";
+							<?php if ( $auto_submit_authcode ) { ?>


Could we use the variable state to generate a JS variable instead? That would allow us to eventually move this JS into an external file and pass that as data to the script.

Something like const autoSubmitEnabled = <?php echo json_encode( ... ); ?> and then use that here in pure JS if-check?

Happy to make this change! How/where would you like the JS variable to be output? I could output it as a data attribute on the form element (something like data-auto-submit) or could output it as a small <script> snippet in the <head> tag so it's a global variable that can be accessed. I kind of lean toward the data attribute to keep it scoped to the form itself.

@kasparsd any thoughts on the question above on approach?

@kasparsd @jeffpaul I opted to add a data attribute on the form and check for that in the JS if statement. Seems pretty clean to me. Take a look and let me know what you think!

…ithin JS

class-two-factor-core.php

georgestephanis · 2026-02-12T14:04:53Z

class-two-factor-core.php

 		?>

-		<form name="validate_2fa_form" id="loginform" action="<?php echo esc_url( self::login_url( array( 'action' => $action ), 'login_post' ) ); ?>" method="post" autocomplete="off">
+		<form name="validate_2fa_form" id="loginform" action="<?php echo esc_url( self::login_url( array( 'action' => $action ), 'login_post' ) ); ?>" method="post" autocomplete="off"<?php if ( $auto_submit_authcode ) { ?> data-auto-submit="true"<?php } ?>>


I appreciate this running through a data attribute -- though as I'm looking at a bit of code from TOTP that adds a data-digits parameter in the provider's authentication_page()

two-factor/providers/class-two-factor-totp.php

Line 768 in 69706ea

<input type="text" inputmode="numeric" autocomplete="one-time-code" name="authcode" id="authcode" class="input authcode" value="" size="20" pattern="[0-9 ]*" placeholder="123 456" autocomplete="one-time-code" data-digits="<?php echo esc_attr( self::DEFAULT_DIGIT_COUNT ); ?>" />

that's what populates the expectedLength variable -- I'm wondering if instead it would be better to filter the data-digits property on the element? Maybe not include the attribute or something if it's filtered to null instead?

Also, kind of out-of-scope for this, but I'd like to see the autosubmit also work for codes that are alphanumeric or the like, so if it could maybe be elevated out of the "only numbers" conditional, but that's minor quibbles.

masteradhoc · 2026-02-22T09:52:41Z

Hey @eric-michel,

Could you take a moment to review the comments from @georgestephanis?
Your feedback would help us move forward and get this PR merged soon.

Thanks again for your contributions!

github-actions · 2026-02-22T09:52:52Z

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: eric-michel <ytfeldrawkcab@git.wordpress.org>
Co-authored-by: masteradhoc <masteradhoc@git.wordpress.org>
Co-authored-by: kasparsd <kasparsd@git.wordpress.org>
Co-authored-by: jeffpaul <jeffpaul@git.wordpress.org>
Co-authored-by: georgestephanis <georgestephanis@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

class-two-factor-core.php

Co-authored-by: George Stephanis <daljo628@gmail.com>

eric-michel · 2026-03-02T20:38:02Z

@masteradhoc @georgestephanis My apologies for being AWOL for a bit! Work got busy for a while.

@georgestephanis if I'm understanding correctly, you're suggesting instead of having a separate data attribute for whether autosubmit is active or not, instead utilize the preexisting data-digits attribute and assign it to null or similar in order to determine when autosubmit is turned off? If so, I can definitely experiment with that.

georgestephanis · 2026-03-02T23:27:20Z

Yup! Basically if it doesn't have a length set, it won't autosubmit?

Co-authored-by: Brian <brian@brianhaas.li>

eric-michel · 2026-03-03T15:48:16Z

@georgestephanis See if you're happy with this implementation.

georgestephanis · 2026-03-03T16:14:00Z

I'm gonna have to think on this a bit -- I wanna make sure we're passing stuff around and parsing it out of the dataset well. I'll do some tinkering and get back to you ideally this evening?

added filter to control whether authcode autosubmits

808cd6a

eric-michel mentioned this pull request Dec 18, 2025

Add hook to turn off auto-submission of 2FA form #723

Open

jeffpaul added this to the 0.15.0 milestone Dec 18, 2025

jeffpaul linked an issue Dec 18, 2025 that may be closed by this pull request

Add hook to turn off auto-submission of 2FA form #723

Open

jeffpaul requested a review from kasparsd December 18, 2025 23:31

jeffpaul assigned eric-michel Dec 18, 2025

kasparsd approved these changes Dec 22, 2025

View reviewed changes

eric-michel added 2 commits December 23, 2025 12:43

updated readme

00605f2

swapped variable output to data attribute on form and check happens w…

bd499ec

…ithin JS

eric-michel requested a review from jeffpaul February 3, 2026 20:34

georgestephanis requested changes Feb 12, 2026

View reviewed changes

masteradhoc modified the milestones: 0.15.0, 0.16.0 Feb 18, 2026

masteradhoc reviewed Feb 25, 2026

View reviewed changes

class-two-factor-core.php Show resolved Hide resolved

masteradhoc and others added 2 commits February 25, 2026 21:27

Merge branch 'master' into auto-submit-hook

5acf913

add provider_key

aac5403

Co-authored-by: George Stephanis <daljo628@gmail.com>

eric-michel and others added 3 commits March 3, 2026 09:35

filter documentation added

628a461

Co-authored-by: Brian <brian@brianhaas.li>

Merge branch 'WordPress:master' into auto-submit-hook

da121df

shifted auto-submit check to data-digits attribute

749a8f0

georgestephanis mentioned this pull request Mar 4, 2026

Alternative to #741 - Autosubmit Tweak #820

Open

Conversation

eric-michel commented Dec 18, 2025

What?

Why?

How?

Testing Instructions

Changelog Entry

Uh oh!

kasparsd left a comment

Choose a reason for hiding this comment

Uh oh!

kasparsd Dec 22, 2025

Choose a reason for hiding this comment

Uh oh!

eric-michel Dec 23, 2025

Choose a reason for hiding this comment

Uh oh!

jeffpaul Jan 6, 2026

Choose a reason for hiding this comment

Uh oh!

eric-michel Jan 9, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

georgestephanis Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

masteradhoc commented Feb 22, 2026

Uh oh!

github-actions bot commented Feb 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

eric-michel commented Mar 2, 2026

Uh oh!

georgestephanis commented Mar 2, 2026

Uh oh!

eric-michel commented Mar 3, 2026

Uh oh!

georgestephanis commented Mar 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

github-actions bot commented Feb 22, 2026 •

edited

Loading