[PR #2414] [MERGED] fix: invalidate all sessions when enabling TOTP #8247

New Issue

2026-04-20T18:06:45-05:00

GiteaMirror commented

2026-04-20 18:06:45 -05:00

📋 Pull Request Information

Original PR: https://github.com/go-vikunja/vikunja/pull/2414
Author: @kolaente
Created: 3/18/2026
Status: ✅ Merged
Merged: 3/19/2026
Merged by: @kolaente

Base: main ← Head: fix/invalidate-sessions-on-totp-enable

📝 Commits (1)

178fb5d fix: invalidate all sessions when enabling TOTP

📊 Changes

3 files changed (+11 additions, -2 deletions)

View changed files

📝 frontend/src/i18n/lang/en.json (+2 -1)
📝 frontend/src/views/user/settings/TOTP.vue (+4 -1)
📝 pkg/routes/api/v1/user_totp.go (+5 -0)

📄 Description

When a user enables 2FA, pre-existing sessions were not invalidated, allowing them to continue refreshing tokens without ever being challenged for a TOTP code. This adds session invalidation on TOTP enable (matching the existing behavior on password change) and updates the frontend to inform the user they will be logged out and to properly trigger a logout after enabling.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/go-vikunja/vikunja/pull/2414 **Author:** [@kolaente](https://github.com/kolaente) **Created:** 3/18/2026 **Status:** ✅ Merged **Merged:** 3/19/2026 **Merged by:** [@kolaente](https://github.com/kolaente) **Base:** `main` ← **Head:** `fix/invalidate-sessions-on-totp-enable` --- ### 📝 Commits (1) - [`178fb5d`](https://github.com/go-vikunja/vikunja/commit/178fb5dc7cb332b7d0872a7f9a2fc7bf7688f76e) fix: invalidate all sessions when enabling TOTP ### 📊 Changes **3 files changed** (+11 additions, -2 deletions) <details> <summary>View changed files</summary> 📝 `frontend/src/i18n/lang/en.json` (+2 -1) 📝 `frontend/src/views/user/settings/TOTP.vue` (+4 -1) 📝 `pkg/routes/api/v1/user_totp.go` (+5 -0) </details> ### 📄 Description When a user enables 2FA, pre-existing sessions were not invalidated, allowing them to continue refreshing tokens without ever being challenged for a TOTP code. This adds session invalidation on TOTP enable (matching the existing behavior on password change) and updates the frontend to inform the user they will be logged out and to properly trigger a logout after enabling. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2026-04-20 18:06:45 -05:00

GiteaMirror closed this issue

2026-04-20 18:06:46 -05:00

Sign in to join this conversation.

Branches Tags

main

renovate/ip-address-10.x

renovate/basic-ftp-6.x

renovate/intlify-shared@-11.4.14-11.x

renovate/postgres-18

log-request-origin-human-api-mcp

fix-empty-trash-modal-light-mode-text

simplify-filter-syntax-non-technical-users

feat/link-preview-cards-og-metadata

pr-swarm-assets

feat-revoke-access-remove-webhooks-link-shares

fix/harden-73-audit-prompt

feat/revoke-link-shares-on-access-removal

remove-mptcp-godebug-mitigation

sign-windows-desktop-installer-3718

feat/trash-tasks-frontend

feat/project-task-counts

explore-project-filter

fix-refresh-recovery

feat/remove-proxy-password

feat/remove-deprecated-webhook-proxy-keys

feat/quick-add-highlighting

feat-mcp

feature/gh-3818-due-date-hotkey

feat-user-entitlements

feat/migration-cancel

perf/project-access-cache

feat-admin-scope-warning

feat-instance-admin-bots

fix-bot-token-expiry-notify

fix-admin-token-scopes

fix-drop-legacy-admin-scope-aliases

fix-sqlite-database-locked

perf/combined

perf/conn-lifetime

perf/api-token-cache

perf/project-touch-no-hook

remove-native-plugin-system

fix-rootpath-relative-defaults

task-detail-sidebar-redesign

screenshots/task-detail-sidebar

consolidate-data-folder

fix-multiline-add-task-order

gh-readonly-queue/main/pr-3363-654bb9493053299350c37d355cb426e045d72353

feat-project-templates

feat-soft-delete-projects

feat-run-as-user

claude/task-event-field-changes-ws73g2

feat-audit-sinks

claude/per-user-feature-toggles-vqlg8x

docs-v2-query-param

claude/veans-question-xBFkq

spike-huma-openapi3

claude/investigate-swagger3-support-nyyUa

feat-list-view-buckets

ci-mysql-8-test

codex/analyze-codebase-for-email-task-feature

csv-import-feature

claude/email-reply-comments-wpdcQ

fix-oidc-pkce-support

fix/overview-subtasks-expand

feat/bucket-select-task-detail

claude/review-bot-design-plan-cf5C3

claude/project-scoped-api-tokens-KTqR3

claude/explore-openclaw-integration-KQEzg

claude/project-scoped-api-tokens-yv5KS

fix-duplicate-close-button

feat-list-view-sorting

feat/official-vite-sentry-plugin

feat/highlight-overdue-tasks

feat/add-enter-key-form-submission-handling

feat/TipTap-nits

feat/update-caldavtimetotimestamp-parsing

feat-phosphor-icons

wip-plans

claude/investigate-issue-2173-llKme

fix-description-text-drag

feat-custom-keyboard-shortcuts

pr-1845-ci

codex/fix-drag-and-drop-behavior-inconsistency

copilot/add-clickable-labels-for-filtering

copilot/fix-issue-1786

playwright-migration

fix-kanban-repeating-wip

copilot/fix-1498

feature/replace-axios

codex/upgrade-to-tailwind-4.1.8-using-pnpm

codex/add-cypress-test-for-avatar-types

feature/biome

feature/oxc

codex/update-flexsearch-to-0.8.205

4r6ni9-codex/fix-deprecated-sass-@import-usage

codex/fix-deprecated-sass-@import-usage

codex/add-cypress-test-for-task-list-refresh-fix

codex/fix-quick-add-magic-not-adding-tasks

codex/fix-all-type-errors

codex/fix-mimetype-for-docs.json

feature/caldav-from-scratch

feature/gh-actions-hetzner

fix-ci

feat/new-logger

jyte-better-dev-config

feat/add-team-member-with-enter

fix/button-and-icon-types

fix/notifications-component-name-collision

feature/null-time

renovate/tailwindcss-4.x

feature/unplugin-vue-router

fix/deprecated-import

feature/zod-schema

renovate/golangci-golangci-lint-1.x

fix/tiptap-editor-reactive-destructuring

release/0.24

feat/improve-add-task

fix/saved-filter-search

feat/webp-and-avif-attachment-previews

feature/migrate-back-to-bulma

fix/sass-add-missing-list-import

feature/sticky-demo-bar

fix/gantt-view-switch

feature/typesense-position-join

feature/focus-visible

dependencies/golangci-lint

feature/better-filter-syntax

fix/tiptap-task-list

renovate/github.com-golang-jwt-jwt-v4-5.x

feature/hide-forbidden-related-tasks

renovate/golang-1.x

release/0.20

release/0.17

release/0.16

release/0.15

release/0.14

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/vikunja#8247