TOTPDeviceViewSet
Overview
List, set up, activate, and remove the signed-in user's two-factor devices.
All of a user's devices share one allauth TOTP Authenticator and its secret. Sign-in codes for email and SMS are computed from the stored secret when they are sent, so the authenticator app is the only device that holds a copy of the secret. Adding or removing the app therefore gives the authenticator a new secret, which leaves the email and SMS devices working and stops any earlier copy of the app from producing valid codes.
activate
Confirm the code for the device that setup started, and add the device.
The code is checked against the setup secret. The first device creates the user's TOTP authenticator with that secret. An authenticator app added to an existing authenticator replaces its secret with the setup secret. An email or SMS device joins the existing authenticator and leaves its secret unchanged.
Signature
activate(self, request)
Parameters
| Name | Type | Required | Default | Description |
|---|---|---|---|---|
| self | yes | |||
| request | yes |
Source
server/vueda/core/decorators.py:150
destroy
Remove one device by pk, or several by pks in the request body.
Removing the last device turns two-factor authentication off. Removing the authenticator app while other devices remain gives the authenticator a new secret, so the removed app's codes stop working.
Signature
destroy(self, request, args, kwargs)
Parameters
| Name | Type | Required | Default | Description |
|---|---|---|---|---|
| self | yes | |||
| request | yes | |||
| args | no | |||
| kwargs | no |
Source
server/vueda/core/decorators.py:217
get_queryset
Get the list of items for this view. This must be an iterable, and may be a queryset. Defaults to using self.queryset.
This method should always be used rather than accessing self.queryset directly, as self.queryset gets evaluated only once, and those results are cached for all subsequent requests.
You may want to override this if you need to provide different querysets depending on the incoming request.
(Eg. return a list of items that is specific to the user)
Signature
get_queryset(self)
Parameters
| Name | Type | Required | Default | Description |
|---|---|---|---|---|
| self | yes |
Source
server/vueda/user/viewsets.py:58
setup
Start setting up a two-factor device with the requested method.
Each setup generates a new setup secret and keeps it in the session. For totp (an authenticator app), returns that secret and its QR code. For email and sms, sends a code from that secret to destination, so the code proves that the user receives messages there and does not confirm sign-in. The device is added when activate confirms the code.
Signature
setup(self, request)
Parameters
| Name | Type | Required | Default | Description |
|---|---|---|---|---|
| self | yes | |||
| request | yes |
Source
server/vueda/core/decorators.py:75
TOTP_SESSION_KEY
basename
description
detail
detail_args
filterset_class
name
permission_classes
queryset
serializer_class
suffix
Source
server/vueda/user/viewsets.py:41