Skip to content

Conversation

@weijianxian
Copy link
Contributor

Implement SMS-based two-factor authentication during the SSO login process, including a modal for SMS code input and necessary API integrations for sending and verifying the SMS code. This enhances security for user logins.

@klxiaoniu
Copy link
Contributor

klxiaoniu commented Oct 12, 2025

看起来没什么大问题,我有几个疑问:

  1. 图片验证码和短信验证码会同时触发么?修改后的逻辑如果在触发图片验证码的情况下,还是弹备用登录吗?
  2. 短信验证码输错或者触发图片验证码,抛出的error文本都是“登录失败,请检查账号密码是否正确”会不会引起歧义?
  3. 发送验证码弹出Modal时,手机号是否以明文显示,需做脱敏处理?
  4. 发送验证码是否要用户手动点击好一些?

@klxiaoniu
Copy link
Contributor

@weijianxian 看看

@weijianxian
Copy link
Contributor Author

  1. 会同时触发,但是图片验证码经过我的测试是账号登录失败3次之后才会触发, 我们的登录逻辑是一码通登陆完成(确认账号密码正确)之后进行sso,所以没触发过这个图片验证码。在弹出图片验证码的情况下,一码通成功但是sso失败依然备用登录

@klxiaoniu
Copy link
Contributor

这个pr有进展吗

@weijianxian
Copy link
Contributor Author

@ACaiCat 已经把csrf逆出来了,等一个能触发两步认证的号做测试

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants