miguelgrinberg/two-factor-auth-flask

If error happens the user is added but you can't access

Opened this issue · 1 comments

Hi, Miguel. Thank you for this.

I see a problem here.

When you are in development environment some errors may occur, and if something goes wrong at the time you use the register form, the user will be added but no qr code will be showed.

Another thing here is, I'm trying to add some validation for deleting the session username, cause for any reason the page could be reloaded and, again, the user will be added and you won't get access to this added account. Any advice here?

This is a tiny demo application. On a larger application the 2nd factor authentication would be enabled after the account is created, not at the same time. And when the user enables it, they would have to provide the first code. If for any reason they are unable to provide the first code, then the 2nd factor would not be enabled and that would have to go through the process again.