Secure MFA cookie about google-authenticator HOT 5 CLOSED

Heya @Zyphrax this is great! Is there any chance you can open a pull request for this? I agree that using Rails.application.config.force_ssl probably isn't the best option. It probably makes more sense for it to be configurable.

from google-authenticator.

Hi @jaredonline, I saw your note on my pull request.

"If you have multiple classes using MFA you'll trounce your cookies here."
True, it would probably be better to move all of this configuration (time_until_expiration, cookie_key and cookie_options) to the model that is decorated with MFA.

I'm afraid that change is a bit out of my depth :), shall I update the pull request to remove the cookie_key configuration?

from google-authenticator.

Ah! I didn't look here for it.

I think a simple fix would be to have the cookie key just be a suffix for cookie keys:

key = "#{GoogleAuthenticatorRails.cookie_key}" || "mfa_credentials"
"#{klass.to_s.downcase}_#{key}"

from google-authenticator.

I noticed a bug in handling the default value of cookie_key.
I've created a pull request to fix it.

from google-authenticator.

Thanks for pushing the new version!
Case closed :)

from google-authenticator.