Automatically logged out after less then 2 minutes.

[reense]

Hello all,

When I use this package, it throws me out of the backoffice every two minutes or so.
I don't even have this plugin enabled, only installed.

When i monitor the console, I see that after it requests https://localhost:44326/umbraco/backoffice/UmbracoTrees/ContentTree/GetNodes?id=1094&application=content&tree=&isDialog=false, it gives the following 401:

)]}',
{"Message":"Authorization has been denied for this request."} 

is there some kind of timeout parameter I need to set for it to not throw me out every two minutes?

[tommyw]

Also experiencing this issue. It doesn't appear to be cookie expiration. I'll see if I can debug, but any thoughts would be appreciated!

[tommyw]

The only thing that I can see at the moment that might be this:
https://github.com/Offroadcode/Umbraco-2FA/blob/master/Umbraco2FA/Umbraco/Fortress/Startup/FortressOwinStartup.cs#L66

app.UseTwoFactorSignInCookie(global::Umbraco.Core.Constants.Security.BackOfficeTwoFactorAuthenticationType, TimeSpan.FromMinutes(5));

will try adjusting the 5 minute cookie timeout

[reense]

The only thing that I can see at the moment that might be this:
https://github.com/Offroadcode/Umbraco-2FA/blob/master/Umbraco2FA/Umbraco/Fortress/Startup/FortressOwinStartup.cs#L66

app.UseTwoFactorSignInCookie(global::Umbraco.Core.Constants.Security.BackOfficeTwoFactorAuthenticationType, TimeSpan.FromMinutes(5));

will try adjusting the 5 minute cookie timeout

I saw that too about a week ago. But since it times out within two minutes, I don't think that is our problem.. I will also continue investigating this :)

[reense]

@tommyw Did you find anything yet? I'm still searching but i cant find the problem..

[tommyw]

@reense nope, afraid not. haven't spent a huge amount of time on it though. will hopefully be able to find a bit more time next week.

[tommyw]

@reense I just realised that there's mean to be an umbraco2FA admin section, but when I assign it to the administrators group, it causes the back office to fall over.

So.... I'm really not sure where to go from here. Neither of the Fortress DB tables offer any settings for timeout. I think it must be something to do with the authenticate API call, and found this: https://github.com/Offroadcode/Umbraco-2FA/blob/master/Umbraco2FA/Umbraco/Fortress/Controllers/TwoFactorAuthController.cs#L70
but that's not included in the .csproj, so I guess it's old.

I'll try to get the whole solution, with the JS/grunt running locally, might provide some clues.

[reense]

@tommyw Hmm, that's what I found as well. However, I'm still clueless why this issue is occurring. There is nothing in the code that suggests it automatically logs out. I think it could also be some exception that is silently occurring, and then logging out because of that. Still investigating..

[tommyw]

@cssquirrel Hi Kyle. Have you experienced this issue at all?

[PeteDuncanson]

Hey folks, its been pretty flat out crazy busy here at Offroadcode Towers so sorry for the lack of response.

For a little history the 2FA stuff was originally part of a bigger project which had a collection of security goodies in it that we called Fortress hence all the references. We chose to release the 2FA stuff separately but to do that we had to rip out some of the other goodies but we did it in a bit of a hurry. As a result there are some left over artefacts in there which might prove to be red herrings, sorry.

Timeout wise I can't think of anything off the top of my head but that cookie timeout would certainly be worth bumping up to see if it did anything. I'll ask around in the office this week and see what we can come up with.

Thanks for your interest in the package though and your keenness to help us get to the bottom of these issues :)

[tommyw]

Cheers Pete, appreciate it. Would be a great addition to U7, and hopefully will be rolled into U8!

[reense]

se the 2FA stuff separately but to do that we had to rip out some of the other goodies but we did it in a bit of a hurry. As a result there are some left over artefacts in there which might prove to be red herrings, sorry.

Timeout wise I can't think of anything off the top of my head but that cookie timeout would certainly be worth bumping up to see if it did anything. I'll ask around in the office this week and see what we

Great, thank you! Looking forward to hearing what your colleagues said ;)

[iKomettech]

@PeteDuncanson Any Solution for the above issue?

[ozgn]

still waiting for the response

[jamiehowarth0]

Timed it. It's 60 seconds, and I think I know why.

Notice the expiry date on the .AspNet.UmbracoTwoFactorCookie - Unix epoch. I think the cookies aren't being sent properly by the middleware.

[jamiehowarth0]

Upon further investigation, basically Umbraco's backoffice has a bespoke cookie manager class, which determines whether Umbraco's auth middleware needs to be invoked when authorising requests. The UseTwoFactorSignInCookie uses the default CookieAuthenticationOptions class, which is very sparse and doesn't contain anything to do with paths (here's where we get to the crux). As a result, the cookie times out cause it's both the wrong path options, and the wrong cookie manager.

I'm hoping to have this fixed soon as a result using Umbraco's own cookie middleware settings, but it's taking some time as now Umbraco is refusing to accept that the 2FA provider is registered. Once I've debugged that, I should have a PR ready soon.