"Current Device" for Trusted Devices does not work

[aschempp]

Affected version(s)
4.9

Description
The current implementation to detect the current trusted device will not work reliably. We are storing the trusted device cookie data, but the data will change for ever user that has logged in (all users are stored in the same cookie).

There are only two options:

1. remove "current device" for trusted devices
2. duplicate probably 80% of the 2FA Trusted Devices code of scheb/two-factor-bundle

😞

I'm not sure whats best… option 1 means we can't tell the user the current device – not so nice. Option 2 means we're getting rid of even more of the bundle, and I start wondering if we (should) need it at all. But then we need to re-invent the wheel all over again …

[bytehead]

2. duplicate probably 80% of the 2FA Trusted Devices code of scheb/two-factor-bundle

I do have some working code laying around. But exactly with this issue, because you need to write your own DeviceTokenStorage.

[bytehead]

To keep it simple as it gets I personally vote for option 1.

[leofeyer]

Can you point me to the problematic code please?

[aschempp]

Can you point me to the problematic code please?

Not sure what you mean. https://github.com/contao/contao/blob/master/core-bundle/src/Security/TwoFactor/TrustedDeviceManager.php#L72 stores the current cookie value, but the cookie value can contain multiple trusted device tokens.

[leofeyer]

@bytehead has explained the issue to me (thank you again). Now that I understand it, I also vote for option 1, not showing "this device" in the device list.

[leofeyer]

Closing this in favor of #1299.