Issue #2930355: One-time login link bypasses TFA (!13) · Merge requests · project / tfa · GitLab

GitLab now enforces expiry dates on tokens that originally had no set expiration date. Those tokens were given an expiration date of one year later. Please review your personal access tokens, project access tokens and group access tokens to ensure you are aware of upcoming expirations. Administrators of GitLab can find more information on how to identify and mitigate interruption, please take a look at our documentation.

Mingsong requested to merge issue/tfa-2930355:2930355-39 into 2.x Sep 21, 2022

Overwrite user reset password login route.
Redirect user to edit form after TFA validation if it is one time login.
New method TfaContext::canResetPassSkip().
New setting to allow the super admin skipping TFA. Default is false.
New test for Tfa password reset.

Edited Oct 21, 2022 by Mingsong