Repository: DefGuard/defguard (language: rust)

Issue:
Enabling MFA only invalidates one session
**Describe the bug**
Enabling MFA invalidates current session to force the user to login again, this time with his MFA of choice. If the user has other active sessions those sessions will still remain active. This is problematic, as it's possible to disable previously enabled MFA from those sessions (or do anything that a logged in user can do, at least until the session expires) without the need to provide otherwise required one time password/keys/wallets etc.

**To Reproduce**
Steps to reproduce the behavior:
1. Have at least 2 sessions active
2. Enable MFA on one of the sessions, this session will be invalidated afterwards
3. Observe that the second session is still active

**Expected behavior**
Enabling MFA should invalidate all sessions of a user.



Discussion / hints:

Fix patch:
diff --git a/src/handlers/auth.rs b/src/handlers/auth.rs
index 1da00d909..de277b421 100644
--- a/src/handlers/auth.rs
+++ b/src/handlers/auth.rs
@@ -210,7 +210,7 @@ pub async fn logout(
 /// Enable MFA
 pub async fn mfa_enable(
     cookies: CookieJar,
-    session: Session,
+    _session: Session,
     session_info: SessionInfo,
     State(appstate): State<AppState>,
 ) -> Result<(CookieJar, ApiResponse), WebError> {
@@ -220,9 +220,9 @@ pub async fn mfa_enable(
     if user.mfa_enabled {
         info!("Enabled MFA for user {}", user.username);
         let cookies = cookies.remove(Cookie::from("defguard_sesssion"));
-        session.delete(&appstate.pool).await?;
+        user.logout_all_sessions(&appstate.pool).await?;
         debug!(
-            "Removed auth session for user {} after enabling MFA",
+            "Removed auth sessions for user {} after enabling MFA",
             user.username
         );
         Ok((cookies, ApiResponse::default()))


Test patch: