Moritz Heiber 7e12aac61c Only allow token authentication with 2FA enabled (#2184) ...

* Don't allow for plain username/password authentication when 2FA is enabled

* Removed debugging statement

* Don't assume a token belongs to a given user, handle two-factor errors properly

* Simplified user/token matching, refactored error handling for two-factor authentication

* Change authentication response to avoid bruteforcing

* Add TODO item as a comment for changing the response for security purposes

2017-07-26 15:33:16 +08:00

15 KiB

Raw Blame History

View Raw