ethiele/signage
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix: Trusted-Device-Cookie überlebt jetzt den Logout

Browse Source 
- resp.delete_cookie('mfa_trust') aus /logout entfernt
- Cookie wird nur noch bei MFA-Deaktivierung/Passwort-Reset gelöscht
- Debug-Prints entfernt, users.json aufgeräumt
This commit is contained in:
Erik Thiele
2026-07-10 16:17:08 +02:00
parent b9e7b2e074
commit 106ec2d897
2 changed files with 24 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
app.py
View File

@@ -517,9 +517,6 @@ def login():
# Trusted Device prüfen (Cookie überspringt MFA) # Trusted Device prüfen (Cookie überspringt MFA)
trust_token = request.cookies.get("mfa_trust") trust_token = request.cookies.get("mfa_trust")
if trust_token: if trust_token:
users_data = load_users()
user_data = users_data.get(email, {})
trusted = user_data.get("trusted_devices", [])
now = datetime.now() now = datetime.now()
# Abgelaufene Einträge bereinigen # Abgelaufene Einträge bereinigen
active = [d for d in trusted active = [d for d in trusted
@@ -537,6 +534,8 @@ def login():
if user.must_change_password: if user.must_change_password:
return redirect("/change-password") return redirect("/change-password")
return redirect("/admin") return redirect("/admin")
else:
pass
except (ValueError, KeyError): except (ValueError, KeyError):
pass pass
if changed: if changed:
@@ -566,9 +565,7 @@ def logout():
email = current_user.email if current_user.is_authenticated else "unknown" email = current_user.email if current_user.is_authenticated else "unknown"
logout_user() logout_user()
add_history_entry("user_logout", f"User '{email}' abgemeldet", email) add_history_entry("user_logout", f"User '{email}' abgemeldet", email)
resp = redirect("/login") return redirect("/login")
resp.delete_cookie("mfa_trust")
return resp
# ------------------------------------------------- # -------------------------------------------------

34
users.json
View File

@@ -15,10 +15,11 @@
"FC204A", "FC204A",
"1D09D7" "1D09D7"
], ],
"mfa_secret": "VOLBXT7HYK6BXBD32EGW7CMFLVD53QON" "mfa_secret": "VOLBXT7HYK6BXBD32EGW7CMFLVD53QON",
"trusted_devices": []
}, },
"erik.thiele@cancom.de": { "erik.thiele@cancom.de": {
"password_hash": "scrypt:32768:8:1$gyBs4dA7DhH9wA0u$c80f25262388095545733c95dd4e569eee610fa849a11dd28d4f504d09e23d3768adad26d4ed671975bd3dcbae5dc43bd982f4d475e6bc9d2ede088cb0b6c025", "password_hash": "scrypt:32768:8:1$D8XYprsEYMO5EPrG$2829b18f77bbd7d9f0cbb945b0bdbc32e16d7889f8711881f82dd35accd26ddb7c31d3fa85e3b89d19d6d1f0b92d8d18765e1c82044188cab8fd0db2d35a0d15",
"role": "admin", "role": "admin",
"sites": [], "sites": [],
"must_change_password": false, "must_change_password": false,
@@ -26,17 +27,23 @@
"last_name": "Thiele", "last_name": "Thiele",
"department": "CSO", "department": "CSO",
"notes": "Standort Stuttgart", "notes": "Standort Stuttgart",
"mfa_secret": "CHKS2QZOJ45TSCLUN7FWO3MLTMRSS6Q3", "mfa_secret": "LR5DYI3SQPMW5XWKO33HPETHY5TPOWRG",
"mfa_enabled": true, "mfa_enabled": true,
"mfa_recovery_codes": [ "mfa_recovery_codes": [
"1FB378", "7BBD93",
"AAD593", "EB1D3B",
"B4BCB9", "BEE291",
"9CB5C3", "D471D5",
"22D614", "D43C00",
"26F3B7", "75DBAC",
"47FB5C", "8B00CB",
"50BB59" "7AF72D"
],
"trusted_devices": [
{
"token": "5kMgj4JPxd2IHuzV5MagAAcYyi_DBImyGimBSvZUNVg",
"expires": "2026-07-24T15:40:28.955130"
}
] ]
}, },
"test1@test.de": { "test1@test.de": {
@@ -51,6 +58,7 @@
"first_name": "test", "first_name": "test",
"last_name": "tester", "last_name": "tester",
"department": "addff", "department": "addff",
"notes": "asdasdasd" "notes": "asdasdasd",
"trusted_devices": []
} }
} }