Modify throttling flow; lockout login procedure in response to hitting two-factor authentication limit

Author: michaeldzjap

src/Http/Controllers/ThrottlesTwoFactorAuths.php

@@ -4,10 +4,14 @@
 
 use Illuminate\Auth\Events\Lockout;
 use Illuminate\Cache\RateLimiter;
+use Illuminate\Foundation\Auth\ThrottlesLogins;
 use Illuminate\Http\Request;
+use Illuminate\Support\Str;
 
 trait ThrottlesTwoFactorAuths
 {
+    use ThrottlesLogins;
+
     /**
      * Determine if the user has too many failed two-factor authentiction attempts.
      *
@@ -16,9 +20,7 @@ trait ThrottlesTwoFactorAuths
      */
     protected function hasTooManyTwoFactorAuthAttempts(Request $request)
     {
-        return $this->limiter()->tooManyAttempts(
-            $this->throttleKey($request), 3, 1
-        );
+        return self::hasTooManyLoginAttempts($request);
     }
 
     /**
@@ -29,7 +31,7 @@ protected function hasTooManyTwoFactorAuthAttempts(Request $request)
      */
     protected function incrementTwoFactorAuthAttempts(Request $request)
     {
-        $this->limiter()->hit($this->throttleKey($request));
+        self::incrementLoginAttempts($request);
     }
 
     /**
@@ -44,15 +46,19 @@ protected function sendLockoutResponse(Request $request)
             $this->throttleKey($request)
         );
 
-        $message = __('two-factor-auth.throttle', ['seconds' => $seconds]);
+        $message = __('twofactor-auth::twofactor-auth.throttle', ['seconds' => $seconds]);
 
-        $errors = [$this->fieldname() => $message];
+        $errors = [$this->username() => $message];
 
         if ($request->expectsJson()) {
             return response()->json($errors, 423);
         }
 
-        return redirect()->back()->withErrors($errors);
+        return redirect()->to('/login')
+            ->withInput(
+                array_only($request->session()->get('two-factor:auth'), [$this->username(), 'remember'])
+            )
+            ->withErrors($errors);
     }
 
     /**
@@ -85,7 +91,7 @@ protected function fireLockoutEvent(Request $request)
      */
     protected function throttleKey(Request $request)
     {
-        return $request->session()->get('two-factor:auth:id').'|'.$request->ip();
+        return Str::lower($request->session()->get('two-factor:auth')[$this->username()]).'|'.$request->ip();
     }
 
     /**

src/Http/Controllers/TwoFactorAuthenticatesUsers.php

@@ -33,10 +33,10 @@ public function showTwoFactorForm()
      */
     public function verifyToken(VerifySMSToken $request)
     {
-        // If the class is using the ThrottlesLogins trait, we can automatically throttle
-        // the two-factor authentication attempts for this application. We'll key this by
-        // the user id in the session storage and the IP address of the client making
-        // these requests into this application.
+        // If the class is using the ThrottlesTwoFactorAuths trait, we can automatically
+        // throttle the two-factor authentication attempts for this application.
+        // We'll key this by the username in the session storage and the IP address
+        // of the client making these requests into this application.
         if ($this->hasTooManyTwoFactorAuthAttempts($request)) {
             $this->fireLockoutEvent($request);
 
@@ -77,7 +77,6 @@ protected function attemptTwoFactorAuth(Request $request)
         $user = User::findOrFail($request->session()->get('two-factor:auth:id'));
 
         if (resolve(TwoFactorProvider::class)->verify($user, $request->input('token'))) {
-            $request->session()->forget('two-factor:auth:id');
             auth()->login($user);   // If SMS code validation passes, login user
 
             return true;
@@ -98,6 +97,8 @@ protected function sendTwoFactorAuthResponse(Request $request)
 
         $this->clearTwoFactorAuthAttempts($request);
 
+        $request->session()->forget('two-factor:auth');
+
         return redirect()->intended($this->redirectPath());
     }
 
@@ -109,7 +110,7 @@ protected function sendTwoFactorAuthResponse(Request $request)
      */
     protected function sendFailedTwoFactorAuthResponse(Request $request)
     {
-        $errors = [$this->fieldname() => __('two-factor-auth.failed')];
+        $errors = ['token' => __('twofactor-auth::twofactor-auth.failed')];
 
         if ($request->expectsJson()) {
             return response()->json($errors, 422);
@@ -127,22 +128,22 @@ protected function sendFailedTwoFactorAuthResponse(Request $request)
      */
     protected function sendKillTwoFactorAuthResponse(Request $request)
     {
-        $errors = [$this->fieldname() => __('two-factor-auth.expired')];
+        $errors = [$this->username() => __('twofactor-auth::twofactor-auth.expired')];
 
         if ($request->expectsJson()) {
             return response()->json($errors, 401);
         }
 
-        return redirect()->back()->withErrors($errors);
+        return redirect()->to('/login')->withErrors($errors);
     }
 
     /**
-     * Get the input field identifier to be used by the controller.
+     * Get the login username to be used by the controller.
      *
      * @return string
      */
-    public function fieldname()
+    public function username()
     {
-        return 'token';
+        return 'email';
     }
 }

src/Http/Requests/VerifySMSToken.php

@@ -13,7 +13,7 @@ class VerifySMSToken extends FormRequest
      */
     public function authorize()
     {
-        if ($this->session()->has('two-factor:auth:id')) {
+        if ($this->session()->has('two-factor:auth')) {
             return true;
         }
 

src/resources/lang/en/twofactor-auth.php

@@ -18,7 +18,7 @@
     'send' => 'Send Token',
 
     'failed' => 'Invalid authentication token provided.',
-    'throttle' => 'Too many authentication attempts. You will be redirected to the login page. Please try again in :seconds seconds.',
-    'expired' => 'The authentication token has expired. You will be redirected to the login page.',
+    'throttle' => 'Too many two-factor authentication token attempts. Please try again in :seconds seconds.',
+    'expired' => 'The two-factor authentication token has expired.',
 
 ];

src/resources/lang/nl/twofactor-auth.php

@@ -18,7 +18,7 @@
     'send' => 'Verstuur Token',
 
     'failed' => 'Ongeldige authenticatie token aangeleverd.',
-    'throttle' => 'Te veel authenticatie pogingen. Je wordt automatisch teruggestuurd naar de login pagina. Probeer het alsjeblieft opnieuw over :seconds seconden.',
-    'expired' => 'De authenticatie token is verlopen. Je wordt automatisch teruggestuurd naar de login pagina.',
+    'throttle' => 'Te veel authenticatie token pogingen. Probeer het alsjeblieft opnieuw over :seconds seconden.',
+    'expired' => 'De authenticatie token is verlopen.',
 
 ];