Repository navigation
Prepare MFA verification before authenticator code entry - #140
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Commerce previously looked up the authenticator and created its challenge after receiving the code, adding two provider round trips before verification. Prepare the challenge before enabling code entry so submitted codes reach verification sooner; this removes an avoidable timing risk without changing WorkOS’s code acceptance window.
The preparation is signed, short-lived, and bound to the exact user, organization, session, factor, and challenge. Preparation has a separate durable budget; verification keeps its existing five-attempt limit. Successful verification rechecks current factor ownership before issuing a receipt, and duplicate challenge receipts still fail closed. The form handles preparation failures, expiration, timeouts, and duplicate submission.
Validation: focused MFA route, proof, form, authentication guard, and database regressions; web and database typechecks; translation catalog checks; module boundaries; local browser QA of preparation and retry states. Independent adversarial and release reviews completed before merge. Live code acceptance near a rollover remains dependent on WorkOS and has not been claimed as reproduced.