Two step verification example not working - Fix provided

[hayos]

The two step registration with TOTP and QR code generation does not work on master.

Steps to reproduce:

• Login -> Sign up
• Create user and check 'Use two step verification'
• Open link from e-mail: http://localhost:8083/registrationConfirm?token=22b4bec6-xxxx-xxxx-xxxx-a5dff7026c62
• No barcode show (I now have one)

My fix is provided in https://github.com/hayos/spring-security-registration_fork/tree/origin/reenable-2fa-and-i8n-german in the initial commit.

I also internationalized to German to get rid of unpleasant error messages, which is the second commit. And some minor GUI fixes.

Take care you undo my changes in the first lines of README.md.

[ulisseslima]

Thanks, @hayos.

This issue will remain open while we look into this.

Were you following a specific article?

[hayos]

It was following https://www.baeldung.com/spring-security-two-factor-authentication-with-soft-token. And true, there is also a number of outdated or even wrong content in it.

• LssSecurityConfig in code is in fact SecSecurityConfig.
• A lot of code I changed is re-printed there in its original form. You'll have to update that. For instance the obsolete URL public static String QR_PREFIX = "https://chart.googleapis.com/chart?chs=200x200&chld=M%%7C0&cht=qr&chl=";

Furthermore, since the sending of the registration email requires a lot of configuration, I simply print it out as log.debug. The contained URL is needed to continue the registration process. And I think you forgot to mention that the user needs to pick up that URL from the e-mail (respectively now from the debug log).

Note that some other things like registration with Captcha are not working anymore as well, due to vanished URLs. You might take the opportunity to update this with working public services.

[hayos]

I also have my doubts that passing the model in any of the redirect:/ calls in RegistrationController.java is of any use.
For example:
return new ModelAndView("redirect:/console", model);
Since I observed that the passed model is always empty in the @GetMapping("/qrcode") method the following should suffice:
return new ModelAndView("redirect:/console");
(Actually a strange behaviour of Spring Boot 3.1 I do not understand.)

But please, this is just an observation. There might be side effects, it would need to be tested well if you change it.

[ulisseslima]

Thanks for the additional info, @hayos, that'll certainly help.