Ed Morley [:emorley] Reporter
	Description • 9 years ago

1) Enable TOTP 2FA
2) Ensure you have at least one outstanding request targeted at you (eg needinfo)
3) Log out
4) Enter your username + password to start the login process
5) At the "Please enter your verification code from your TOTP application" page, look at the header

Expected:
The header does not display the red circle that shows the number of outstanding requests for that user. (Also, but to a lesser extent, it probably shouldn't display the logged in user email address and navigation menu that links to prefs etc)

Actual:
The outstanding request count is shown, as is the logged in user email/navigation menu.


Whilst none of this information is sensitive [1] - it gives the impression that 2FA isn't working, which is disconcerting and doesn't lead to confidence in the system :-)


[1] the outstanding request count doesn't really add any value - all it would let someone do is guess number of outstanding requests on bugs that are private, by comparing to the count returned from unauthenticated request.cgi calls

	:glob ✱
	Comment 1 • 9 years ago

this is already fixed as part of bug 1199087