MFA findings in a penetration test #7256

3 Answer(s)

• 

  0

  liangshiwei created 23 days ago

  Support Team Fullstack Developer

  HI,

  Abp uses standard ASPNETCore Identity to implement MFA authentication.

  We will consider supporting it in the 8.3 if it's possible.

  Any suggestions/guidance is greatly appreciated as we need to have the application certified by this security firm.

  You might consider rewriting the send security code and verifying code methods.

  For example:

  public class MyAccountAppService: AccountAppService
  {
      ...
      
      public override async Task SendTwoFactorCodeAsync(SendTwoFactorCodeInput input)
      {
          // send the code and store in a distributed cache
          // You can set the cache expiration time to make the code expire in the future
      }
  }
  

  public class MySignInManager : AbpSignInManager
  {
      public override async Task<...> TwoFactorSignInAsync(....)
      {
          // check the distributed cache, If the code cache does not exist, return invalid code
          
          
          var result = base.TwoFactorSignInAsync(...);
          
          // If the login is successful, remove the code from the distributed cache
          // if the login is not successful, number of attempts + 1
          
          return result;
          
      }
  }
  

  Save Cancel
• 

  0

  balessi75 created 19 days ago

  Hi liangshiwei,

  Thank you for the guidance. I'll be giving your approach a try...

  Save Cancel
• 

  0

  liangshiwei created 17 days ago

  Support Team Fullstack Developer

  okay

  Save Cancel