Authentication code error message about devise-two-factor HOT 6 CLOSED

It's possible to display a specific message when only the authentication code is incorrect with a few changes to your model and the Devise language configuration file.

#app/models/user.rb
#...

  def unauthenticated_message
    if @failed_otp
      :invalid_otp
    else
      super
    end
  end

  def validate_and_consume_otp!(code, options = {})
    @failed_otp = !super(code, options)
    return !@failed_otp
  end

  private

  @failed_otp = false

#...

#config/locales/devise.en.yml

en:
  devise:
    failure:
      invalid_otp: "Invalid authentication code."

from devise-two-factor.

in config/locales/devise.en.yml you can set the majority of the message Devise uses.

to do authentication on login specifically, look for the invalid entry, and change it something like this:

en:
  devise:
    failure:
      invalid: "Invalid %{authentication_keys}, one-time-use code, or password."

from devise-two-factor.

+1

from devise-two-factor.

@ZempTime that is helpful, but I don't think it works around the original issue, which is that it should be possible for a specific message to be shown when the authentication is invalid but the username and password are valid.

from devise-two-factor.

@mattcg perfect to my situation! I added a little bit:

def unauthenticated_message
  if @failed_otp
    :invalid_otp
  elsif self.otp_required_for_login
    :required_otp
  else
    super
  end
end

from devise-two-factor.

This is a perfectly valid use-case, but it's worth keeping in mind the usability / security trade-off that's being made. More specific messages are helpful to the user, but they also provide more information to an attacker.

For example, depending on what error messages you use, an attacker that compares a leaked username / password list from another site against your login form will either gain no information about whether the user exists, or they will learn that the user does exist, and that they shared their password across the two sites. From there, they might opt to perform a more targeted attack against the user.

Whether that's something you're concerned with is up for debate, but it's worth remembering when deciding to provide more detailed error messages.

from devise-two-factor.