Sign-in with 2FA: ask for the code, not the password again issue #184 closed: completed andymccall opened this 21 days ago · 0 comments

Andy (2026-10-14): the code step asked for the password a second time. Now the password step hands the code step a signed proof (auth::pending_login, five minutes, void when the session salt changes, i.e. a new password), so the code step asks only for the code; a forged or stale proof starts sign-in again.