ethiele/signage
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix: Trusted-Device-Cookie wurde nicht korrekt gespeichert

Browse Source 
- Cookie path explizit auf '/' gesetzt
- login_user() vor Cookie-Setzung aufgerufen (konsistenter Zustand)
- Kein Überschreiben der Response mehr bei must_change_password
This commit is contained in:
Erik Thiele
2026-07-10 15:44:00 +02:00
parent bfbd970f3b
commit b9e7b2e074
1 changed files with 7 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
app.py
View File

@@ -597,6 +597,8 @@ def mfa_verify():
totp = pyotp.TOTP(user.mfa_secret) totp = pyotp.TOTP(user.mfa_secret)
if code and totp.verify(code): if code and totp.verify(code):
login_user(user)
session.pop("mfa_user", None)
# Trusted Device speichern wenn gewünscht # Trusted Device speichern wenn gewünscht
remember_days = request.form.get("remember") remember_days = request.form.get("remember")
if remember_days: if remember_days:
@@ -604,28 +606,22 @@ def mfa_verify():
days = int(remember_days) days = int(remember_days)
if 1 <= days <= 365: if 1 <= days <= 365:
token = secrets.token_urlsafe(32) token = secrets.token_urlsafe(32)
expires = datetime.now().isoformat() exp_date = datetime.now() + timedelta(days=days)
exp_date = datetime.now()
exp_date = exp_date + timedelta(days=days)
expires = exp_date.isoformat() expires = exp_date.isoformat()
users_data = load_users() users_data = load_users()
trusted = users_data.setdefault(email, {}).setdefault("trusted_devices", []) trusted = users_data.setdefault(email, {}).setdefault("trusted_devices", [])
trusted.append({"token": token, "expires": expires}) trusted.append({"token": token, "expires": expires})
save_users(users_data) save_users(users_data)
resp = redirect("/admin") add_history_entry("user_login", f"User '{email}' angemeldet (mit MFA, Gerät für {days} Tage gespeichert)", email)
target = "/change-password" if user.must_change_password else "/admin"
resp = redirect(target)
resp.set_cookie("mfa_trust", token, max_age=days * 86400, resp.set_cookie("mfa_trust", token, max_age=days * 86400,
path="/",
httponly=True, samesite="Lax", httponly=True, samesite="Lax",
secure=False) secure=False)
login_user(user)
session.pop("mfa_user", None)
add_history_entry("user_login", f"User '{email}' angemeldet (mit MFA, Gerät für {days} Tage gespeichert)", email)
if user.must_change_password:
resp = redirect("/change-password")
return resp return resp
except (ValueError, TypeError): except (ValueError, TypeError):
pass pass
login_user(user)
session.pop("mfa_user", None)
add_history_entry("user_login", f"User '{email}' angemeldet (mit MFA)", email) add_history_entry("user_login", f"User '{email}' angemeldet (mit MFA)", email)
if user.must_change_password: if user.must_change_password:
return redirect("/change-password") return redirect("/change-password")