[5.x]: Required two-step verification applies to users without control panel access

[mikejpeters]

What happened?

Description

In the User Settings the Require two-step verification help text says "Choose which users must use two-step verification when accessing the control panel.", but after setting this to All users, it seems to apply even to users without control panel access.

Steps to reproduce

1. Under User Settings set Require two-step verification to All users
2. Create a user without any permissions
3. Attempt to sign into the frontend

Expected behavior

User should have access to the frontend without setting up 2fa

Actual behavior

Two-Step Verification Setup screen is displayed with the message:
Your account requires two-step verification. Please enable one of these methods before proceeding.

Craft CMS version

5.9.17

PHP version

No response

Operating system and version

No response

Database type and version

No response

Image driver and version

No response

Installed plugins and versions

[linear]

CMS-1910

[brandonkelly]

This is expected behavior as of Craft 5.6+ (see #16344).

Before that, it was possible to login and maintain a session on the front-end for accounts which required 2FA, which gave attackers an easy way to bypass 2FA restrictions and still have full access to that user’s privileges via manually-executed action requests, even if they couldn’t actually access the control panel pages.

If you don’t want to require 2FA for front-end accounts, you can limit it to certain user groups instead.

[mikejpeters]

Thank you for the reply, but I was hoping to require two-step verification for all users who have the Access the control panel permission. (I understand that if 2FA is enforced for a user it has to be done even during frontend logins)

If this isn't a planned feature, please consider re-labelling the switch, because it's misleading:

[brandonkelly]

Doh, thanks for pointing that out. Just updated that instruction text for the next release.