diff --git a/CHANGELOG.md b/CHANGELOG.md index c2df192..4724858 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,10 @@ # Changelog +## 0.1.0.0045 — 2026-07-11 + +### Changed +- MFA enforcement: after saving email in settings, if TOTP is not enabled, a blocking overlay forces the user to set up two-factor on the Authelia portal before proceeding + ## 0.1.0.0044 — 2026-07-11 ### Added diff --git a/VERSION b/VERSION index 762552e..9ee9f65 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -0.1.0.0044 +0.1.0.0045 diff --git a/main.go b/main.go index b9d42dd..78c36b7 100644 --- a/main.go +++ b/main.go @@ -762,13 +762,16 @@ func checkMFAStatus(w http.ResponseWriter, r *http.Request) { return } - // Call Authelia API to check TOTP status + // Attempt to call Authelia API to check TOTP status. + // This requires an active user session (firstfactor completed), + // so it may return 403 if called server-side without session. token := os.Getenv("AUTHELIA_SECRET") req, _ := http.NewRequest("GET", "http://authelia:9091/api/user/info", nil) req.Header.Set("Authorization", "Bearer "+token) resp, err := http.DefaultClient.Do(req) - if err != nil { + if err != nil || resp.StatusCode != 200 { + // Can't verify TOTP status server-side. Show prompt if email is set. json.NewEncoder(w).Encode(map[string]bool{"mfa_enabled": false}) return } @@ -1054,19 +1057,24 @@ const settingsHTML = ` {{t .Lang "saved"}} - -