Jacaranda2FA 01.00.00 — First Public Test Release

Jacaranda2FA 01.00.00 is the first public testing release of the Jacaranda2FA two-factor authentication provider for DNN Platform.

This release promotes the confirmed-working 00.00.31 development baseline to version 01.00.00. The authentication and security logic is unchanged from that tested baseline; this release primarily formalises versioning, packaging, documentation, and public testing guidance.

Tested compatibility

Jacaranda2FA 01.00.00 has been tested successfully with:

DNN Platform 10.3.2
DNN Platform 10.3.3
the default DNN skin
a custom Bootstrap 5 production-style skin
Microsoft Authenticator
Google Authenticator
registered users
SuperUsers
Jacaranda2FA operating as the sole enabled authentication provider
Features
TOTP authenticator-app verification
email one-time verification codes
one-time recovery codes
trusted/remembered browser support
role-based two-factor authentication enforcement
persistent cross-challenge second-factor throttling
TOTP replay protection
configurable OTP lifetime, retry and resend controls
configurable trusted-browser settings
configurable recovery-code settings
security audit logging
user-facing Account Security module
authenticator enrolment, replacement and removal
recovery-code generation and replacement
trusted-browser management and revocation
responsive login and verification controls
Security design

Jacaranda2FA leaves normal username and password validation under DNN control.

The login flow is:

DNN validates the username and password.
Jacaranda2FA determines whether a second factor is required.
The configured second factor is verified.
Only after successful verification is authentication handed back to DNN.
DNN completes the normal authenticated login.

Security hardening includes:

persistent second-factor failure throttling
strict challenge-expiry handling
recent password confirmation before sensitive Account Security changes
protected temporary TOTP enrolment secrets
TOTP replay protection
one-time recovery codes
transactional recovery-code replacement
HTTPS-only trusted-browser issuance
Secure trusted-browser cookies
no-store handling for authenticator setup secrets and newly generated recovery codes
protection against removal of the last usable second factor where 2FA policy requires one
Important authentication-provider warning

Jacaranda2FA can enforce two-factor authentication only for login paths that pass through the Jacaranda2FA provider.

If DNN Normal Login or another independent authentication provider remains enabled, users may be able to authenticate through that provider without passing through Jacaranda2FA.

Before disabling alternative authentication providers:

keep an existing SuperUser session open
verify SuperUser login through Jacaranda2FA in another browser
confirm a usable authenticator, email fallback, or recovery code is available
test both normal-user and SuperUser authentication
Public testing

This is the first public test release.

Administrators are encouraged to test Jacaranda2FA on a staging or non-production DNN installation before relying on it for production authentication.

Feedback from different DNN installations, themes, browsers, SMTP configurations, and authentication policies is welcome.

Security reporting

Please report suspected exploitable security issues privately rather than posting full vulnerability details publicly.

Security reports can be sent to:

webmaster@forrestitservices.org

Do not include passwords, authenticator secrets, recovery codes, trusted-browser tokens, machine keys, SMTP credentials, or database credentials.

Upgrade notes

01.00.00 is promoted directly from the confirmed-working 00.00.31 development baseline.

There is no new database migration in 01.00.00.

Existing 00.00.31 installations can be upgraded directly without uninstalling the existing extension first.

Licence

MIT License

Copyright © 2026 Forrest IT Services