Feature | Add Login UI MFA Flow - #142

Open

matiasperrone-exo wants to merge 21 commits into

feat/mfa---usercontroller-mfa-integration-device-trust-cookie-management-audit-wiring-and-2fa-rate-limiting---cu-86ba2zc6pfrom

feat/mfa---login-ui-flow

Commits on Jul 23, 2026

feat: Add Login UI MFA Flow

matiasperrone-exo
authored and
smarcet
committed
1f2e9b6
fix: rename HTMLRender.jsx to .js so webpack can resolve it
smarcet
committed
cc97f0f
fix: revert password submit to native form POST
smarcet
committed
0eca371
fix: add missing React import in HTMLRender to prevent ReferenceError crash
smarcet
committed
7a8dc5d
fix: cancel login now invalidates the pending MFA challenge server-side
smarcet
committed
e39b715
fix: stop the 2FA verify XHR from following cross-origin OAuth2 redirects
smarcet
committed
f67f5b1
fix: cancel and session-expiry now correctly return to the password screen
smarcet
committed
a062848
fix: clear identity fields from session on MFA cancel/verify-success
smarcet
committed
f338172
fix: invalidate pending MFA challenge when identity chip is cleared
smarcet
committed
ee02cca
fix: block submitting an expired MFA code
smarcet
committed
8c3e6fe
fix: seed the MFA countdown with the remaining OTP lifetime after refresh
smarcet
committed
0330c3b
feat: add expiry countdown to the passwordless OTP form, dedup shared code-entry UI
smarcet
committed
246c777
fix: surface cancelLogin failures instead of swallowing them in console
smarcet
committed
e2fc8e8

Commits on Jul 24, 2026

Commits on Jul 25, 2026

Refactor 2FA rate limiting to use RateLimiter::for() named limiters
smarcet
committed
28b5bc1