Email client security checks trigger duplicate two-factor emails

[spwitt]

Email client security checks trigger duplicate two-factor emails

Description

Some email clients or other security measures may send pre-flight checks for links in emails. For users with email configured as an MFA option, these checks may trigger sending the MFA code via email. The user is sent another MFA code when they navigate to the link in their browser. Only the most recent MFA code is valid.

These are often an HTTP HEAD request, but some clients may use a GET request.

Affects versions

1.33.0-1.46.0

Steps to reproduce

1. Enable MFA for a user via email
2. On the FusionAuth login page, click the Forgot Password link
3. Enter the user's email address and submit the form
4. Copy the change password link from the email (do not click it)
5. Use the curl command or other tool to send a HEAD request to the link to simulate an email client security check (example below)
6. The user should receive an email with an MFA code
7. Now open the password change link in the browser
8. The user receives another MFA code via email
9. Only the second code will work to complete MFA step-up

Here is an example curl command to send the request. Query string parameters have been omitted for brevity but should be provided when making the request.

curl "https://local.fusionauth.io/password/change/UXWpPTWf4qr_vbBoXAIZNTN16R1HXAJagvq7AvOA5ro?<queryString>" --head

Expected behavior

Email client or other pre-flight security checks should not trigger an MFA email to be sent.

Documentation

• Include warning about changes to origin validation to include the port number in Release Notes

[spwitt]

Internal

• https://github.com/FusionAuth/fusionauth-app/pull/273