Page MenuHomePhabricator

When users confirm Duo MFA in the mobile app, live-update the UI
ClosedPublic

Authored by epriestley on Feb 14 2019, 2:15 PM.
Tags
None
Referenced Files
Unknown Object (File)
Thu, Apr 11, 7:35 AM
Unknown Object (File)
Fri, Apr 5, 1:22 PM
Unknown Object (File)
Wed, Apr 3, 12:01 PM
Unknown Object (File)
Wed, Apr 3, 12:01 PM
Unknown Object (File)
Wed, Apr 3, 12:01 PM
Unknown Object (File)
Mar 5 2024, 12:45 PM
Unknown Object (File)
Feb 8 2024, 10:11 PM
Unknown Object (File)
Jan 29 2024, 2:40 AM
Subscribers
None

Details

Summary

Ref T13249. Poll for Duo updates in the background so we can automatically update the UI when the user clicks the mobile phone app button.

Test Plan

Hit a Duo gate, clicked "Approve" in the mobile app, saw the UI update immediately.

Diff Detail

Repository
rP Phabricator
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

src/applications/auth/factor/PhabricatorAuthFactor.php
213

We don't actually use this anywhere, so I removed it.

src/applications/auth/factor/PhabricatorDuoAuthFactor.php
588

I reduced this timeout slightly since the Duo API seems pretty responsive, we have the live update thing now, and the 5-second timer can mean that some normal page responses wait 5 seconds, which feels icky. Specifically:

  • Start an MFA gate.
  • Cancel.
  • Hit the same MFA gate.

The second dialog takes 5 seconds to come up since we're checking the status of the current active challenge and have to wait for the call to timeout if you don't press the button during those 5 seconds.

684–689

This default result moved here so it can have access to $challenges.

amckinley added inline comments.
webroot/rsrc/js/phui/behavior-phui-timer-control.js
37

Was this supposed to be 1000?

This revision is now accepted and ready to land.Feb 15 2019, 4:59 PM
webroot/rsrc/js/phui/behavior-phui-timer-control.js
37

This one's intentionally 10,000: so the AJAX endpoint can long-poll for 5 seconds.

The other one is 1,000: wait one second between retries.

A "phutil_units" equivalent would be nice in JS, but we don't currently have one.

This revision was automatically updated to reflect the committed changes.