Django-mfa2

Latest version: v3.0

Safety actively analyzes 688554 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 1 of 5

3.0

This is a major cleanup and CSS adjustments so please test before deployment.

* Updated to fido2==1.1.3
* Removed: CBOR and exchange is done in JSON now.
* Removed: `simplejson` package from dependencies.
* Email OTP is always 6 numbers.
* Better support for bootstrap 4 and 5.
* Added: the following settings
* `MFA_FIDO2_RESIDENT_KEY`: Defaults to `Discouraged` which was the old behaviour
* `MFA_FIDO2_AUTHENTICATOR_ATTACHMENT`: If you like to have a PLATFORM Authenticator, Defaults to NONE
* `MFA_FIDO2_USER_VERIFICATION`: If you need User Verification
* `MFA_FIDO2_ATTESTATION_PREFERENCE`: If you like to have an Attention
* `MFA_ENFORCE_EMAIL_TOKEN`: if you want the user to receive OTP by email without enrolling, if this the case, the system admins shall make sure that emails are valid.
* `MFA_SHOW_OTP_IN_EMAIL_SUBJECT`: If you like to show the OTP in the email subject
* `MFA_OTP_EMAIL_SUBJECT`: The subject of the email after the token allows placeholder '%s' for otp

2.9.0

* Add: Set black as code formatter
* Add: Add Pyre as a type checker
* Add: Add pre-commit hooks
* Upgrade: fido to be 1.1.0 as minimum

2.8.0

* Support For Django 4.0+ JSONField
* Removed jsonfield package from requirements

2.7.0

* Fixed 70
* Add QR Code for trusted device link
* Better formatting for trusted device start page.

2.6.1

* Fix: CVE-2022-42731: related to the possibility of registration replay attack.
Thanks to 'SSE (Secure Systems Engineering)'

2.6.0

Not secure
* Adding Backup Recovery Codes (Recovery) as a method.
Thanks to Spitfireap for work, and peterthomassen for guidance.
* Added: `RECOVERY_ITERATION` to set the number of iteration when hashing recovery token
* Added: `MFA_ENFORCE_RECOVERY_METHOD` to enforce the user to enroll in the recovery code method once, they add any other method,
* Added: `MFA_ALWAYS_GO_TO_LAST_METHOD` to the settings which redirects the user automatically to the last used method when logging in
* Added: `MFA_RENAME_METHODS` to be able to rename the methods for the user.
* Fix: Alot of CSS fixes for the example application

Page 1 of 5

© 2024 Safety CLI Cybersecurity Inc. All Rights Reserved.