Organizr: [V2] 2FA login breaks with LastPass Chrome extension

[Terror-Gene]

Organizr Version: V 2.0.0-beta.800

Branch: v2-develop

WebSever: Nginx

Operating System: Docker/UNRAID

---

Problem Description:

When attempting to login using the LastPass Chrome extension, clicking login gives the following message:

"Login Error
2FA-incorrect"

But the 2FA Code prompt never appears.

I assume the problem is that the code field is being filled out in the background by LastPass.
If I disable the LastPass Autofill, reload the page & manually type my username & password it prompts for 2FA.
With LastPass Autofill disabled, if i click the lastpass icon & select my account (filling the fields) the login fails.

---

Reproduction Steps:

• Have 2FA activated
• Install the LastPass Chrome extension
• Store Organizr username & password in LastPass
• Attempt to login to Organizr using LastPass

---

Errors on screen? If so paste here:

Login Error
2FA-incorrect

[causefx]

hmmm, that doesnt make sense as on the first login call, the api will return if 2fa is needed, if so, it will display the 2fa box. I dont have last pass to try but I do use 1password and it works fine with that. I will try and test soon.

[brambaars]

I'm experiencing the same behaviour; and I can reproduce it just like @Terror-Gene .

I am using Authy for 2FA; but Lastpass have their own 2FA implementation as well. Since the 2FA box is not shown I suspect the Lastpass extensions enters an invalid 2FA code automatically.

I found that when I edit the Organizr entry in my Lastpass vault, then click the wrench to _Edit Form Fields_, there is a field with name _tfaCode_ and a 6 digit entry.

After deleting that field, I get the nice 2FA box again.

Lastpass should not have saved that 2FA token.

[joe-eklund]

I can confirm that deleting the field that @brambaars is referring to did fix it, albeit for only a single login. After I cleared the field, it was then filled out again on the next successful login.

This essentially makes 2FA very tedious to use with LastPass, as I must manually clear out the tfa field in LastPass after every login, otherwise I get the error detailed in @Terror-Gene's original post.

Any ideas on a more permanent solution?

[Terror-Gene]

This use to be a big issue because the 2FA prompt didn't even appear, preventing login.
Not such an issue anymore since now the 2FA prompt appears, but with an old code & the "Login Error, 2FA-incorrect" message.

Not really sure what else can be done, except either somehow blocking lastpass from remembering that field, or lastpass deciding to allow people to properly disable remembered fields.

[Terror-Gene]

In lastpass, if you set the tfaCode field to blank then it stops this issue.
Unfortunately this is only a fix for those that look for it & won't help stop the initial cause.

[causefx]

Downloading the free copy now... Side note - this doesn't happen with Bitwarden nor 1Password.

[causefx]

Here is a video of lastpass in action for me:

https://l.sonflix.com/3g/2587

Am I doing something different than you all?

[causefx]

Nevermind - I see the issue now. Fixing now.

[Terror-Gene]

I just tried changing my settings to repeat your example & yes, mine is different & shows the 2fa prompt with the old code.
I'm wondering if this is a browser specific addon issue?
I'm on Windows using Chrome btw.

[causefx]

If you are on Dev branch - you can test what I just pushed.

[Terror-Gene]

Ah, awesome. thank you! as simple as that in the end lol. i probably should have looked into lastpass tags or something ages ago!

[causefx]

nw - so did it work for ya?

[Terror-Gene]

Unfortunately I'm not on dev & cant spin up another copy atm.

[tronyx]

@joe-eklund @brambaars @Terror-Gene Can anyone confirm whether or not the changes made in the develop branch have resolved this issue?

[brambaars]

I'm running master branch on docker, and am not so experienced to try to install an extra dev branch. Sorry, cannot confirm...
I truly appreciate the effort though!

[causefx]

I will merge to master after we test the latest commits.

[Terror-Gene]

I can confirm that it appears to have worked. I tried to double check to verify by returning to the Master branch but then proceeded to get very confused till i realised the changes were made to the Master branch! From what i can see Organizr no longer saves 2FA codes.
Thanks causefx!