feat(auth): require MFA JWT for TOTP enrolment - #21037
Draft
StaberindeZA wants to merge 1 commit into
Draft
Conversation
StaberindeZA
force-pushed
the
fxa-14311
branch
6 times, most recently
from
August 20, 2026 12:10
8bf3c4b to
9170fad
Compare
StaberindeZA
force-pushed
the
fxa-14311-backend
branch
from
August 20, 2026 16:14
a346538 to
60b4622
Compare
Because:
- Step-up auth re-enters no password, so a hijacked session could enrol
an AAL2 factor and trigger the destructive recovery-method clear with
only a session token — no proof of email possession.
This commit:
- Consolidates the TOTP enrolment routes onto /mfa/totp/{create,setup/verify,
setup/complete}, guarded by the `mfa` strategy + `mfa:2fa` scope, and removes
the ungated session-token routes so enrolment always requires an email-OTP JWT.
- Removes the now-dead session-token TOTP methods (create/verify/complete and
the replace pair) from fxa-auth-client; only the *WithJwt variants remain.
- Migrates the auth-server test client to mint an mfa:2fa JWT for TOTP setup,
and updates the functional-test enableTotpOnAccount helper and its call sites
to the email-OTP/JWT flow.
- Adds route-guard unit assertions and an integration test proving a bare
session token is rejected (401/223) before reaching the enrolment handlers.
Closes FXA-14390
StaberindeZA
force-pushed
the
fxa-14311-backend
branch
from
August 20, 2026 16:27
60b4622 to
e5e5825
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Because
/totp/create— with only a session token, no proof of email possession. This requires an email-OTP-derivedmfa:2faJWT for all TOTP enrolment, closing that hole.This pull request
/mfa/totp/{create,setup/verify,setup/complete}, guarded by themfastrategy +mfa:2fascope, and removes the ungated session-token routes so enrolment always requires the JWT.fxa-auth-client; only the*WithJwtvariants remain.mfa:2faJWT for setup, and the functionalenableTotpOnAccounthelper + call sites to the email-OTP/JWT flow.Issue that this pull request solves
Closes: FXA-14390
Checklist
How to review
fxa-14311; retarget tomainonce feat(settings): require OTP for inline TOTP enroll #21001 merges.packages/fxa-auth-server/lib/routes/totp.js(route consolidation + auth strategy).POST /v1/totp/createwith only a session token — this PR removes that path./fxa-security-reviewcompleted (net improvement; no diff-level findings).Other information
nx lint(auth-server, auth-client, functional-tests) ✅;totp.spec.tsunit 24/24 ✅; the 5 affected integration specs 84/84 ✅.