826
98%

Ran 04 Jan 2021 10:43PM UTC

Jobs 1

Files 28

Run time 6s

Badge

Embed ▾

pending completion

Build # 826

Build Type

push

travis-ci

Committed by

web-flow

Commit Message

Fix security vuln - QRcodes were available via GET on /qrcode - not protected with CSRF tokens (#423)

Looking into how others do this (e.g. paypal) - the QRcode is embedded in the successful response to form POST.
So - /tf-qrcode and /us-qrcode endpoints have been completely removed.

A successful response to POST /tf-setup or /us-setup will contain the embedded QRcode in addition to the constituent parts: key, username, and issuer. This allows for manual authenticator app setup. In addition the JSON response to these POST calls also have that information.

Simpler, more secure - what's not to like.

Factored out the actual creation of the QRcode to an overridle method in the TOTP class - so application can easily change size, color ,etc.
closes: #418

Run Details

3020 of 3083 relevant lines covered (97.96%)

0.98 hits per line

Jobs

ID	Job ID	Ran	Files	Coverage
4	826.4 (REQUIREMENTS=release)	04 Jan 2021 10:43PM UTC	0	97.96	Travis Job 826.4

Source Files on build 826

Detailed source file information is not available for this build.

Flask-Middleware / flask-security / 826
98%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 826

Flask-Middleware / flask-security / 826 98%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 826

Flask-Middleware / flask-security / 826
98%

README BADGES
x