JetConfirmsPassword on Confirming 2FA

[hailwood]

• Jetstream Version: 2.7.1
• Jetstream Stack: both
• Uses Teams: N/A but no
• Laravel Version: N/A but 9.6.0
• PHP Version: N/A but 8.1.0
• Database Driver & Version: N/A

Description:

In the Inertia stack the Confirm button for 2FA is wrapped in

<JetConfirmsPassword @confirmed="confirmTwoFactorAuthentication">...</JetConfirmsPassword>

However the input on the form the button relates to triggers the same function via the enter key

@keyup.enter="confirmTwoFactorAuthentication"

Meaning the confirms password can be bypassed by simply pressing enter on the input.

Similary for the Livewire stack it's wrapped in

<x-jet-confirms-password wire:then="confirmTwoFactorAuthentication">

However the input on the form the button relates to triggers the same function via the enter key

wire:keydown.enter="confirmTwoFactorAuthentication"

I believe this wrapping JetConfirmsPassword/x-jet-confirms-password probably shouldn't be there as the user would have recently confirmed their password when they clicked the Enable button, so unless they clicked enable and then left their device long enough for the confirm password timeout to occur (3 hours by default iirc) they'll never get prompted anyway.

Steps To Reproduce:

Enable 2FA and 2FA Confirming

Relevant Files

https://github.com/laravel/jetstream/blob/2.x/stubs/livewire/resources/views/profile/two-factor-authentication-form.blade.php
https://github.com/laravel/jetstream/blob/2.x/stubs/inertia/resources/js/Pages/Profile/Partials/TwoFactorAuthenticationForm.vue

[driesvints]

Thanks for reporting this. I think removing the key press listeners is the easiest solution for now. I sent in a PR for that here: #1035

[driesvints]

@hailwood we can't seem to recreate this. Pressing enter on the field invokes the password confirmation.

[hailwood]

@driesvints,

It invokes the serverside version -
Check out the video attached. Note that after resetting the confirmed password timeout)

• When we click the button we get the modal 👍
• When we press enter on the field we instead get the full page version as it's the serverside request redirecting us 👎

Having the two flows is definitely not ideal.
What if rather than removing the keyup listener we instead make the keyup listener just click on the button?
That way we're not removing anything but we keep the flows identical :)

2fa-2022-04-08_20.31.58.mp4

Side note, that route I use is just

Route::get('/reset-password-confirm', function () {
    session()->forget('auth.password_confirmed_at');
    return 'done';
});

[driesvints]

In livewire I seem to be getting a 403 model when entering in the code field after executing your route. Fresh Laravel app. This isn't ideal indeed..