cesnimda
b914630657
Adds a "trust this device" option to the 2FA challenge: on success, mints a random token (only its SHA-256 hash is stored), sets it as a new httpOnly, Secure, SameSite=Strict cookie, and records a TrustedDevice row. AuthController checks that cookie for the exact signing-in user before gating on 2FA -- a mismatched user, expired, or revoked device falls through to the normal 2FA prompt, never errors. TwoFactorController also exposes list/revoke/revoke-all endpoints for managing trusted devices, scoped to the owning user. Schema added via the existing raw-SQL reconciler (SQLite + MySQL dialects), not EF migrations, matching this repo's established pattern.
17 lines
708 B
C#
17 lines
708 B
C#
namespace JobTrackerApi.Models;
|
|
|
|
// "Trust this device for 30 days" -- lets a browser skip the 2FA code step after one successful
|
|
// challenge. Never store the plaintext token, only its SHA-256 hash, same rationale as
|
|
// TwoFactorRecoveryCode.CodeHash: a DB read (backup, replica, leaked snapshot) can't be turned
|
|
// into a working cookie.
|
|
public sealed class TrustedDevice
|
|
{
|
|
public int Id { get; set; }
|
|
public string UserId { get; set; } = "";
|
|
public string TokenHash { get; set; } = "";
|
|
public string? DeviceLabel { get; set; }
|
|
public DateTimeOffset CreatedAtUtc { get; set; }
|
|
public DateTimeOffset LastSeenAtUtc { get; set; }
|
|
public DateTimeOffset ExpiresAtUtc { get; set; }
|
|
}
|