Add trusted devices for 2FA

[bytehead]

This is a first draft of a trusted devices implementation for the Contao 2FA.
It uses the built-in stuff from the scheb/two-factor-bundle and I would consider this as a poor man implementation because it only sets a versioned cookie and does not care about user agent or the like.

My advice would be to store a GUID in a cookie or in local storage AND use the User-Agent header to identify and store the device server-side as a trusted device. As of this we can show a list of trusted devices to the user where he easily can remove the ones he wants (or even all).

We should send an email when a new device is flagged as a trusted device. If the user didn't add it, or if he doesn't recognize the device information, he can clear his trusted devices immediately.

ToDo:

• Decide if cookie or local storage
• Store a list of trusted devices server-side (e.g. User-Agent with cookie GUID or the like)
• Send an e-mail if a new trusted device is added
• Implement it as well for frontend users when [RTM] 2FA for frontend scope #363 is merged
• Tests

2FA login screen:

2FA backend module:

2FA frontend module:

[bytehead]

See #265 (comment) as well.

[Toflar]

Local storage and server side sounds like a super strange combination to me?! 😄

[bytehead]

Why? We can use a combination of both to identify trusted devices.

[aschempp]

How is the server supposed to validate data in the local storage?

[bytehead]

🤦‍♂ Was too early in the morning 😂

[richardhj]

It uses the built-in stuff from the scheb/two-factor-bundle and I would consider this as a poor man implementation because it only sets a versioned cookie and does not care about user agent or the like.

A cookie can be set/modified client-side, but the same is for the User-Agent. Why is checking for both cookie and user-agent considered as more secure then?
If you update your Firefox from version 70 to 72, is this still considered as the same trusted device?

[aschempp]

I would assume the cookie is sort of signed to prevent modification. As you can see in the screen shot, only the browser name is shown but not the version, so that should not be a problem?

[leofeyer]

Thanks a lot for your hard work @bytehead.