Skips extra validate when otp attempt looks like its coming from Auth…

[jeremy04]

#127

Assuming you have a Devise setup like this:

class User < ApplicationRecord
  devise :two_factor_authenticatable, :two_factor_backupable, otp_number_of_backup_codes: 10,
         otp_backup_code_length: 6, :otp_secret_encryption_key => ENV['OPT_KEY']

  devise :registerable, :recoverable, :rememberable, :trackable,
         :validatable, :confirmable, :lockable

With a configuration like this:

  config.warden do |manager|
    manager.default_strategies(:scope => :user).delete(:two_factor_authenticatable)
    manager.default_strategies(:scope => :user).delete(:two_factor_backupable)
    manager.default_strategies(:scope => :user).unshift :two_factor_authenticatable
    manager.default_strategies(:scope => :user).unshift :two_factor_backupable
  end

failed_attempts gets called every time validate runs in the cascading strategies.

Assuming you enforce two_factor_backupable strategy first, you can reduce the failed_attempts to not increment twice in the following cases:

• Normal login with invalid password
• OTP enabled, invalid OTP entered less than 7 characters

Unfortunately, it will still increment twice when:

• OTP enabled, invalid OTP entered 7 digits or more

[jeremy04]

I just realized my specific otp_backup_code_length is hard-coded in resembles_backup_code?, so this probably needs to be more generic, or approached a different way.

@bsedat Thoughts?

[SimonVillage]

can we have this fixed please?