OAuth logins with 2FA don't complete first time

[benjojo]

Describe the bug

When a user is authenticating to another site via the peeringdb OAuth system, and they are not logged in to PeeringDB already, and they have 2FA enabled, the flow dumps them into the main page after 2FA, and not the OAuth flow.

To Reproduce
Steps to reproduce the behavior:

1. Launch private browsing window to ensure clean, logged out session.
2. Go to https://bgp.tools/authed/manage-peering to login to bgp.tools with PeeringDB (with a 2FA account)
3. Note how you are dumped to the front page rather than the expected permissions screen.

Expected behavior

For 2FA users to get the permissions screen after 2FA auth, like the non 2FA users do

Who is affected by the problem?

bgp.tools users, and probably anyone else using OAuth logins

What is the impact?

People get confused during login flows. Making PeeringDB OAuth harder to use.

Are there security concerns?

At least one person disabled 2FA because of this

[leovegoda]

This looks important in the context of #1180

[vegu]

I was not able to reproduce this while using OTP for 2FA approach.

However, i was able to reproduce this while using U2F for 2FA approach.

So it seems like a bug with the latter.

[vegu]

@benjojo were you using a U2F device (yubikey, fingerprint scanner, os pin, etc.,) or a one-time-password (google authenticator) as 2FA method?

[benjojo]

I actually don't use 2FA on my PeeringDB account, but I can try and ask the users who hit this

…

On Wed, Jun 15, 2022 at 2:33 PM Stefan Pratter ***@***.***> wrote: @benjojo <https://github.com/benjojo> were you using a U2F device or a one-time-password (google authenticator) as 2FA method? — Reply to this email directly, view it on GitHub <#1191 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AALPK4RZHYKWJ4IUV4JOKJLVPHLS5ANCNFSM5Y24JOUA> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[benjojo]

It was a U2F device yes

[arnoldnipper]

Routed through to 3a as identified as a bug by a developer

[mcmanuss8]

+1

[ChrisMacNaughton]

Enabling TOTP as well as U2F seems to allow me to login via OAUTH