chore(auth): clarify 2fa enable server-side secret verification
swadhinbiswas committed 8 months ago
d77158f
1 parent 1d502c6
commit d77158f
1 file changed
+1 -4
Showing 1 changed file+1-4
▼src/pages/api/auth/2fa/enable.ts
+1-4
| @@ -21,8 +21,7 @@ export const POST: APIRoute = withErrorHandler(async ({ request }) => { | ||
21 | 21 | return badRequest("Token and secret are required"); |
22 | 22 | } |
23 | 23 | |
24 | - // Verify token against the provided secret (which should match what we saved in DB, or we can trust client provided secret during setup flow before enabling) | |
25 | - // Better security: fetches secret from DB. | |
24 | + // Verify token against the server-side secret saved during setup. | |
26 | 25 | const db = getDatabase() as NodePgDatabase<typeof schema>; |
27 | 26 | const user = await db.query.users.findFirst({ |
28 | 27 | where: eq(schema.users.id, userPayload.userId) |
| @@ -30,8 +29,6 @@ export const POST: APIRoute = withErrorHandler(async ({ request }) => { | ||
30 | 29 | |
31 | 30 | if (!user) return unauthorized(); |
32 | 31 | |
33 | - // Check if the provided secret matches the one we stored tentatively (optional check) | |
34 | - // Or just use the one from DB. | |
35 | 32 | const storedSecret = user.twoFactorSecret; |
36 | 33 | if (!storedSecret) { |
37 | 34 | return badRequest("2FA setup not initiated"); |
38 | 35 | |