Overhaul 2FA/MFA: Insecure in current form

[louisprp]

I have noticed some shortcomings of the approach to MFA/2FA implemented with Supabase Auth, specifically regarding the handling of multiple factors. In its current form, it allows users to login without a second verification factor leaving the handling of when and where 2FA is required to the application. While this is fine, there’s the problem with allowing users to enroll multiple authentication factors at once, without requiring a second verification. From the perspective of an attacker this would mean that if they had gained access to your regular login credentials, bypassing 2FA would simply require enrolling another factor while not authenticated and removing legitimate factors afterwards, effectively rendering the whole system useless.

While it can be implemented on an application level that this logic is inaccessible to the user without 2FA, there’s nothing stopping an attacker from calling the appropriate endpoints themselves, which is why I believe this issue needs to be addressed on a larger level.

From what I understand the option to add multiple enrollments was done partially to replace the need for recovery keys, but I could imagine that it might be beneficial for some applications to have that feature (even if it is left to the developer to create means of generating the keys and resetting factors e.g. through edge functions).

In order to mitigate this behavior, I would preliminary suggest an option to disallow the enrollment of additional factors, if a verified factor is already present and the user does not have aal2.

In the future, I believe that optionally enforcing MFA on login would add a lot of value, as it feels clumsy (at least to me) that some parts of the application are accessible without the initial need for 2FA. While I see that there are scenarios where this might be beneficial, I believe that this approach would streamline the login flow for less advanced applications and prevent additional complexity on the implementation.