SMS-based MFA? #4546

trowbrds commented 2025年09月11日 21:50:39 +02:00

We're investigating moving to allauth, but unfortunately, many of our users choose SMS for their 2FA. It seems like perhaps there might have been some discussion about this (#3434), but the link (https://github.com/pennersr/django-allauth/discussions/3438) no longer works.

Would SMS-based MFA method be a welcome contribution?

We're investigating moving to allauth, but unfortunately, many of our users choose SMS for their 2FA. It seems like perhaps there might have been some discussion about this (#3434), but the link (https://github.com/pennersr/django-allauth/discussions/3438) no longer works. Would SMS-based MFA method be a welcome contribution?

maver1ck commented 2025年09月12日 19:17:54 +02:00

That's great idea, we may mimic part of Django Two-Factor Authentication lib
https://django-two-factor-auth.readthedocs.io/en/stable/configuration.html#twilio-gateway

That's great idea, we may mimic part of Django Two-Factor Authentication lib https://django-two-factor-auth.readthedocs.io/en/stable/configuration.html#twilio-gateway

pennersr commented 2025年09月12日 20:42:10 +02:00

It would indeed be a nice feature to offer. Random thoughts:

• Phone support is already there, this can build on top of that.
• Configuration-wise, we need MFA_SUPPORTED_TYPES = {..., "phone"}
• This should only be allowed if the phone number is a true second factor. E.g. if you sign up by phone only, and not provide an email address, then obviously, this wouldn't be MFA.
• To be determined how the UI/interaction would look like. E.g. will we simply rely on the existing add/change phone form which is separate from the MFA section, and, inside the MFA setup, only offer an "Enable/disable phone 2FA" button?

It would indeed be a nice feature to offer. Random thoughts: - Phone support is already there, this can build on top of that. - Configuration-wise, we need `MFA_SUPPORTED_TYPES = {..., "phone"}` - This should only be allowed if the phone number is a true second factor. E.g. if you sign up by phone only, and not provide an email address, then obviously, this wouldn't be MFA. - To be determined how the UI/interaction would look like. E.g. will we simply rely on the existing add/change phone form which is separate from the MFA section, and, inside the MFA setup, only offer an "Enable/disable phone 2FA" button?

Rjevski commented 2026年03月20日 03:51:37 +01:00

I have implemented it in a different way, instead of using the "phone support" in the adapter/etc, I instead:

• extended the Authenticator model to add a new SMS type
• updated allauth.mfa.stages.AuthenticateStage.handle to send the SMS if SMS 2FA is active
• updated allauth.mfa.stages.AuthenticateStage._should_handle to check for the new SMS 2FA type
• added an error message too_many_sms_2fa_codes to allauth.mfa.adapter.DefaultMFAAdapter.error_messages
• created a new "flow" to activate/deactivate SMS, creating the SMS type Authenticator model, sending authenticator added/removed signals and emails
• added new templates and forms for activating/deactivating 2FA SMS
• overriding the existing authenticate form, to add a new "resend SMS" link
• added a model to keep the last N requested codes, along with a manager with methods to cleanup stale ones and "consume" one atomically (by locking and then deleting the row if successful)
• a new rate-limit category of request_sms_2fa_code is added (defaults to 20/m/ip,5/m/key)
• adding a number validates it against app-settings' NUMBER_VALIDATOR so that premium-rate/etc numbers can be rejected (defaults to a noop so everything is allowed)
• the actual generating & sending of the SMS is deferred to an app-settings-configurable SMS_CODE_GENERATOR and SMS_CODE_SENDER so code formats can be varied and any SMS provider can be plugged in

If you are interested, this is something I'm sure I can convince my client to upstream.

I have implemented it in a different way, instead of using the "phone support" in the adapter/etc, I instead: * extended the `Authenticator` model to add a new SMS type * updated `allauth.mfa.stages.AuthenticateStage.handle` to _send_ the SMS if SMS 2FA is active * updated `allauth.mfa.stages.AuthenticateStage._should_handle` to check for the new SMS 2FA type * added an error message `too_many_sms_2fa_codes` to `allauth.mfa.adapter.DefaultMFAAdapter.error_messages` * created a new "flow" to activate/deactivate SMS, creating the SMS type Authenticator model, sending authenticator added/removed signals and emails * added new templates and forms for activating/deactivating 2FA SMS * overriding the existing authenticate form, to add a new "resend SMS" link * added a model to keep the last N requested codes, along with a manager with methods to cleanup stale ones and "consume" one atomically (by locking and then deleting the row if successful) * a new rate-limit category of `request_sms_2fa_code` is added (defaults to `20/m/ip,5/m/key`) * adding a number validates it against app-settings' `NUMBER_VALIDATOR` so that premium-rate/etc numbers can be rejected (defaults to a noop so everything is allowed) * the actual generating & sending of the SMS is deferred to an app-settings-configurable `SMS_CODE_GENERATOR` and `SMS_CODE_SENDER` so code formats can be varied and any SMS provider can be plugged in If you are interested, this is something I'm sure I can convince my client to upstream.