Cannot verify TOTP after successfully setting up 2FA, getting `INVALID_TWO_FACTOR_COOKIES`
I can successfully enable TwoFactor, show the QR and backup codes, and verify it with a generated code. This sets
twoFactorEnabled to TRUE for the user.
However when that user later logs out and back in, and needs to verify their 2FA TOTP code, I get this error INVALID_TWO_FACTOR_COOKIES. No two factor cookies are being set anywhere, and I have tried to log them but they aren't generated by the enable nor verify TOTP in my totp/setup routes.
What could be the issue? Thank you.6 Replies
@Ping would you be able to take a look at this please?
GitHub
better-auth/better-auth
The most comprehensive authentication framework for TypeScript - better-auth/better-auth
@Budi I experienced the same issue as you, but for me it works when I add the sveltekitCookieHelper plugin as the last element in the plugins list. Can you try that too real quick? The only thing that doesn't seem to be working still is the trust device option. I can see the trust device cookie in the browser, but when relogging it still asks for the totp code.
That worked for me too! Are you passing headers to the signIn and other API calls?
Oh that's it! I have totally overseen this 🙈 Thanks a lot!
Oh actually I just noticed that I am experiencing the same problem as this issue describes. Where the trust device only works on the first re-login. Subsequent ones ask for totp again.
https://github.com/better-auth/better-auth/issues/2728
There is a PR though, which should fix this problem. Hope it gets merged soon.
GitHub
Two-factor Plugin - "trust device" feature for TOTP only works for ...
Is this suited for github? Yes, this is suited for github To Reproduce Set up project using the two-factor plugin w/ TOTP. When entering the TOTP, send along the trustDevice property as true. The u...