django.contrib.auth should include support for 2fa out of the box

[Alex Gaynor]

Django did a tremendous service to its users by making strong password hashing be the default. The world is pushing forward, and now 2fa is the next standard that many sites fail to meet.

Django should include support for 2fa out of the box, ideally with support for both u2f and TOTP (Google Authenticator).

[Tim Graham]

​django-developers discussion.

[Tim Graham]

The reception on the mailing list has been positive.

[mlevental]

It should be distinguishable if a user is authenticated with 1 factor or 2, e.g. for checking if the user is already authenticated with the required number of factors so relogging can be omitted. Therefore a field like is_two_factor_authenticated can be added to the User model.

But then it would be unclear whether the existing field is_authenticated means the user is authenticated with 1 or 2 factors.
To find that out one would have to additionally check for the value of is_two_factor_authenticated and this would be cumbersome.
For convenience another field like is_one_factor_authenticated could be introduced. And to make is_authenticated behave correctly it should return True if either is_one_factor_authenticated or is_two_factor_authenticated is True.

What are your thoughts on that?

[Tim Graham]

It would be better to put together a proposal and and post it on the DevelopersMailingList. That reaches a wider audience that the few people following the ticket.