1

I have an app set up with Devise log in and I want to implement two factor authentication with Authy/Twilio. I have it set up where if the user goes to the path /enable_authy they can get a text-code to verify their account. I'm trying to make it so it's required to do this, not just a bonus.

My routes... 

 devise_for :users,
   :controllers => { :omniauth_callbacks => "users/omniauth_callbacks"},
   :path_names => {
    :verify_authy => "/verify-token",
    :enable_authy => "/enable_authy",
    :verify_authy_installation => "/verify-installation"
  }
Beth Knight
  • 187
  • 2
  • 15

1 Answers1

0

Twilio developer evangelist here.

There's no way with the gem itself to force a user to enable two factor authentication. You could, however, ensure this yourself with a before_action in your ApplicationController. You'd just need to check whether your signed in user had Authy enabled and redirect them to /enable_authy if they don't.

Something like:

class ApplicationController < ActionController::Base
  protect_from_forgery with: :exception

  before_action :ensure_authy_enabled

  private

  def ensure_authy_enabled
    return if params[:controller] == "devise/devise_authy"
    if current_user and !current_user.authy_enabled?
      redirect_to user_enable_authy_path
    end
  end
end

You might also want to set a flash message to explain what's happened or store the path the user was intending to visit so that you can redirect them there after they are set up with 2FA.

Let me know if that helps at all.

philnash
  • 70,667
  • 10
  • 60
  • 88
  • I want to have it redirect me to the user_enable_authy_path after they click sign up (with the Devise form). How could I do that? – Beth Knight May 22 '17 at 21:16
  • This would do that, with the added bonus that were they to click away from the enable page without enabling 2fa they'd be directed right back. Give this a go and let me know how you get on. – philnash May 23 '17 at 04:40
  • No, it messes with my home index. I've made it an optional feature for users, but it would be cool if it Authy worked better with Devise. Thanks for help though! – Beth Knight May 23 '17 at 22:36
  • How does it mess with your home index? If you want 2FA to be compulsory it will have to affect every page that a logged in user visits. – philnash May 24 '17 at 14:54