Getting asked for a 2FA code every time you login gets tiresome really quickly. To make it a bit more user-friendly we should add the option to 'trust' a device.
To do
- Add 'Trust this device' checkbox on login
- If checked, remember combination of UUID and browser user agent on the customer
- On newer logins, frontend should send UUID and user agent instead of 2FA code. If a trusted browser with these settings is found, the 2FA can be skipped.
- Add administration view to manage 'My trusted devices'
- Add setting to disallow the use of trusted devices
Initially, I would like to build this only for administration logins. Storefront logins have a much longer TTL so the issue is less important there.
Getting asked for a 2FA code every time you login gets tiresome really quickly. To make it a bit more user-friendly we should add the option to 'trust' a device.
To do
Initially, I would like to build this only for administration logins. Storefront logins have a much longer TTL so the issue is less important there.