-
Notifications
You must be signed in to change notification settings - Fork 20
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Disabling 2FA should ask for the Code once again #16
Labels
Comments
Yes, it should ask for a 2FA validation or to insert the actual password. |
I'd agree on that too. |
What if Mobile is stolen and you are using backup code to access your account? It will ask for code to disable it then how you will provide code? However I am agree that it should ask for whmcs admin password. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Currently when disabling the 2FA on client side there is no step asking for the code a last time -> it directly disables. So for disabling 2FA only a valid session required. I think that this is not enough. Disabling the 2FA should be the same security as like the normal login.
Should disabling the 2FA need the a valid Code for confirmation? Discussion open :)
The text was updated successfully, but these errors were encountered: