Class SecondFactorAuthenticationFilter

java.lang.Object

com.codename1.backend.security.SecondFactorAuthenticationFilter

All Implemented Interfaces:

SecondFactorPolicy, SecurityFilter

public final class SecondFactorAuthenticationFilter
extends Object
implements SecurityFilter, SecondFactorPolicy

Asks a user who has a second factor for it, between their password being accepted and their being signed in.

It is the chain's SecondFactorPolicy: handed an authentication whose first factor has passed, it signs nobody in. It notes in the session who is waiting -- a marker that is not a security context, and that lasts five minutes unless set otherwise -- and redirects to the page that asks for the code. Until the code arrives every request of that session is anonymous.

It is also the filter that takes the code, at POST /login/mfa unless changed, in the field code: a one-time code from the user's authenticator app, or one of their recovery codes. A right one completes the sign-in through the chain's SessionSignIn -- the session id changes, the context is stored, remember-me is issued if it was asked for at the first step, and the user goes where they were going.

Wrong codes are counted twice: for the user, whatever address and session they come from, and for the user at the client's network. Too many of either are answered 429 until time has passed. See MfaConfigurer for the numbers, and for what the two counts together do and do not promise.

Field Summary

Fields

Modifier and Type	Field	Description
static final String	PENDING	The session attribute the pending sign-in is kept under.

Method Summary

Modifier and Type	Method	Description
HttpServer.Response	doFilter(HttpServer.Request request, FilterChain chain)	The answer to request; null when nothing under the chain routes it, which the server answers 404.
HttpServer.Response	intercept(HttpServer.Request request, Authentication authentication, boolean rememberMe)	Decides whether authentication, whose first factor has just been accepted, must present a second.
boolean	requires(Authentication authentication)	Whether authentication is of a user who has a second factor, so that a first factor alone must not make a request theirs.
void	satisfied(HttpServer.Request request, Authentication authentication)	A passkey that verified the user signed them in.

Methods inherited from class Object

clone, equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

PENDING

public static final String PENDING

The session attribute the pending sign-in is kept under.

See Also:

• Constant Field Values

Method Details

intercept

public HttpServer.Response intercept(HttpServer.Request request,
 Authentication authentication,
 boolean rememberMe)

Description copied from interface: SecondFactorPolicy

Decides whether authentication, whose first factor has just been accepted, must present a second.

Specified by:

intercept in interface SecondFactorPolicy

Parameters:

rememberMe - whether the user asked to be remembered: to be handed back to SessionSignIn.complete(HttpServer.Request, Authentication, boolean, AuthenticationSuccessHandler), since the request that finishes the sign-in is not the one that asked

Returns:

null to let the sign-in complete now; otherwise the answer to this request -- a redirect to where the second factor is asked for -- with the sign-in left pending

requires

public boolean requires(Authentication authentication)

Description copied from interface: SecondFactorPolicy

Whether authentication is of a user who has a second factor, so that a first factor alone must not make a request theirs.

SecondFactorPolicy.intercept(HttpServer.Request, Authentication, boolean) is for a sign-in that can stop and ask. This is for the ways of presenting a first factor that cannot: credentials sent with every request, which have no second step to send a code in, and a remember-me cookie, which has nobody at the keyboard. Each asks here and refuses the user when the answer is true; see MfaConfigurer for the rule of each mechanism.

A policy that does not say is taken to require one of everybody.

Specified by:

requires in interface SecondFactorPolicy

satisfied

public void satisfied(HttpServer.Request request,
 Authentication authentication)

A passkey that verified the user signed them in. Whoever ran the count of wrong codes up was not them, or no longer matters: it is forgotten, so their next one-time code is not refused for somebody else's guesses.

Specified by:

satisfied in interface SecondFactorPolicy

doFilter

public HttpServer.Response doFilter(HttpServer.Request request,
 FilterChain chain)
                             throws Exception

Description copied from interface: SecurityFilter

The answer to request; null when nothing under the chain routes it, which the server answers 404.

Specified by:

doFilter in interface SecurityFilter

Throws:

Exception