Support MFA/2-step verification

[ptz0n]

Until this feature is implemented, we suggest that you disable MFA for your Verisure user. Please see instructions.

Error: Cookie missing from response: HTTP 200

MFA/2FA flow

1. POST /auth/login using basic auth, as we always done to get step up token
2. POST /auth/mfa using step up token cookie vs-stepup
3. POST /auth/mfa/validate using the same step up token cookie and pass the SMS code as body {"token":"<code>"} to get auth cookie
4. POST /auth/trust using the auth cookie to get long lived trust cookie vs-trust-<redacted>

Suggested solution:

In order to retrieve the vid cookie, we could provide an interactive cli tool:

$ ./cli.js 
verisure: email:  foo@bar.com
verisure: password:

 One-time code sent. 

verisure: code:  FAKE12

 Token for config: "vid=<redacted>"

---

🙌 Please contribute by sharing your ideas and comments.

[ptz0n]

Confirmed: We should persist and use the refreshToken.

curl 'https://m-api02.verisure.com/auth/token' -X 'POST' \
  -H 'Content-Length: 0' \
  -H 'Cookie: vs-refresh=<refreshToken>'

{
  "accessToken": "<redacted>",
  "accessTokenMaxAgeSeconds": 900,
  "refreshToken": "<redacted>",
  "refreshTokenMaxAgeSeconds": 63068527
}

[ptz0n]

And we can use the accessToken to perform requests.

curl 'https://m-api02.verisure.com/graphql' \
  -H 'Cookie: vid=<legacyToken>; vs-access=<accessToken>' \
  --data-raw $'{
    "operationName": "GetInstallation",
    "variables": {
      "giid": "<redacted>"
    },
    "query": "query GetInstallation($giid: String!) { installation(giid: $giid) { alias } }"
  }'

{
  "data": {
    "installation": {
      "alias": "Strandvägen"
    }
  }
}

[palletodap]

Be aware that the function for disabling verification on Versiures website seems to only work in English language.

Every time i tried at first in Danish, it just reloaded the page. After changing to English it worked perfectly.

[ptz0n]

Progress. I've now tested the MFA flow and can confirm that we still only need the vid cookie to make authenticated API requests. This one, according to the set cookie header, will expire after one (1) year. It's unknown if it could expire as a result of any other event.

• vs-stepup cookie is required for validating the one time SMS code. Expires after 20 minutes.
• vs-access cookie is required to retrieve a vs-trust cookie, which could be helpful if we want to rotate the vid cookie using only username & password. Expires after 15 minutes.
• vs-refresh cookie can be used to retrieve a new token using the endpoint /auth/token. Expires after 2 years.
• vs-trust-… cookie can be used when authenticating with username and password to bypass MFA. Expires after ~68 years.

[ptz0n]

Just released v1.14.0 with support for MFA. Happy Wednesday 🎉

[redjoto]

Thumbs up! 👍🏼

[hoefs]

Works great!!! Thanks!!!

[pierre-jean42]

Hello, I just installed your plugin and am very excited to try it, unfortunately I have not figured out how to complete the installation. Presumably because of the 2FA on my account. I tried running npx homebridge-verisure to get the code, but instead I received Error: Request failed with status code 401

Do you happen to know what I should do? I'm running homebridge from an M1 iMac. Thanks eitherway!