MFA findings in a penetration test #7256

3 Answer(s)

• 

  0

  liangshiwei created 5 months ago

  Support Team Fullstack Developer

  HI,

  Abp uses standard ASPNETCore Identity to implement MFA authentication.

  We will consider supporting it in the 8.3 if it's possible.

  Any suggestions/guidance is greatly appreciated as we need to have the application certified by this security firm.

  You might consider rewriting the send security code and verifying code methods.

  For example:

  public class MyAccountAppService: AccountAppService
  {
      ...
      
      public override async Task SendTwoFactorCodeAsync(SendTwoFactorCodeInput input)
      {
          // send the code and store in a distributed cache
          // You can set the cache expiration time to make the code expire in the future
      }
  }
  

  public class MySignInManager : AbpSignInManager
  {
      public override async Task<...> TwoFactorSignInAsync(....)
      {
          // check the distributed cache, If the code cache does not exist, return invalid code
          
          
          var result = base.TwoFactorSignInAsync(...);
          
          // If the login is successful, remove the code from the distributed cache
          // if the login is not successful, number of attempts + 1
          
          return result;
          
      }
  }
  

  Save Cancel
• 

  0

  balessi75 created 5 months ago

  Hi liangshiwei,

  Thank you for the guidance. I'll be giving your approach a try...

  Save Cancel
• 

  0

  liangshiwei created 5 months ago

  Support Team Fullstack Developer

  okay

  Save Cancel