Magento rest API can still be accessed without 2FA even after enabling 2FA.

[SimonPrins]

Preconditions

1. Magento version 2.3.2

Steps to reproduce

1. Enable 2FA.
2. Obtain an admin access token.
3. Use any of the admin rest API calls with the access token.

Expected result

1. I would expect you to have to fill in a 2FA access token somewhere before being allowed to use any admin API calls, since a large potion of critical admin only functionality can be accessed through the API. For instance an optional two-factor code field could be added to the admin token API. Then when 2FA is enabled the code would have to be validated and refuse to grant an access token unless a valid authentication code is provided.

Actual result

1. The rest API calls can be used without requiring 2FA.

[nathanjosiah]

Thank you for opening this issue! I am closing this along with others due to 2fa currently undergoing a very large internal rewrite/refactor this change is being addressed in the new version.