langgenius/dify
1
0
Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-07-21 12:05:30 -04:00
Code Issues 775 Packages Projects Releases 10 Wiki Activity

[PR #26329] feat: add Multi-Factor Authentication (MFA) support #31395

New Issue
Open
opened 2026-02-21 20:49:23 -05:00 by yindo · 0 comments
yindo commented 2026-02-21 20:49:23 -05:00
Owner
Copy Link
Copy Source

Original Pull Request: https://github.com/langgenius/dify/pull/26329

State: open
Merged: No

feat: Add Multi-Factor Authentication (MFA) support with TOTP

  • Add MFA settings page in account settings
  • Implement TOTP-based authentication
  • Add MFA verification during login
  • Add database migration for MFA settings
  • Add comprehensive test coverage for MFA
  • Support for multiple languages
  • Add pyotp and qrcode dependencies

Important

  1. Make sure you have read our contribution guidelines
  2. Ensure there is an associated issue and you have been assigned to it
  3. Use the correct syntax to link this PR: Fixes #<issue number>.

Summary

This PR adds Multi-Factor Authentication (MFA) support to Dify using Time-based One-Time Password (TOTP) authentication.

close https://github.com/langgenius/dify/issues/26391

This is a clean reimplementation based on PR #26112, which had become severely outdated after 2 months of upstream changes. The original PR had 86 files with many unrelated modifications and significant merge conflicts. This implementation focuses only on MFA-specific changes (46 files) and is fully compatible with the latest main branch.

Key Features:

  • TOTP Authentication: Industry-standard time-based one-time passwords
  • QR Code Setup: Easy setup with any authenticator app (Google Authenticator, Microsoft Authenticator, etc.)
  • Backup Codes: Recovery codes for account access if device is lost
  • Security Features: Rate limiting, encrypted storage, session validation
  • Full i18n Support: Available in 20+ languages
  • Optional: MFA is disabled by default, users can opt-in

Technical Implementation:

  • New MFA service layer with comprehensive security measures
  • Database migration for MFA settings storage
  • RESTful API endpoints for MFA management
  • React components for settings and verification
  • Extensive test coverage (unit, integration, security tests)

Dependencies:

  • pyotp==2.9.0 - TOTP implementation
  • qrcode==7.4.2 - QR code generation

Screenshots

Before After
Account Settings without MFA Account Settings with MFA option
![MFA Settings Page]
Standard login flow Login with MFA verification step
![MFA Verification]

Checklist

  • This change requires a documentation update, included: Dify Document
  • I understand that this PR may be closed in case there was no previous discussion or issues. (This doesn't apply to typos!)
  • I've added a test for each change that was introduced, and I tried as much as possible to make a single atomic change.
  • I've updated the documentation accordingly.
  • I ran dev/reformat(backend) and cd web && npx lint-staged(frontend) to appease the lint gods

Testing Instructions

  1. Pull this branch and run database migrations:

    cd docker
docker-compose up -d
docker-compose exec api flask db upgrade

  2. Navigate to Account Settings → Multi-Factor Authentication

  3. Enable MFA:

    • Click "Enable MFA"
    • Scan QR code with your authenticator app
    • Enter verification code
    • Save backup codes

  4. Test login with MFA:

    • Log out
    • Log in with username/password
    • Enter MFA code from authenticator app

  5. Test disable/re-enable flow

Related Context

  • Reimplements #26112 (outdated after 2 months)
  • Addresses security enhancement requests for enterprise deployments
  • No breaking changes - fully backward compatible
**Original Pull Request:** https://github.com/langgenius/dify/pull/26329 **State:** open **Merged:** No --- # feat: Add Multi-Factor Authentication (MFA) support with TOTP - Add MFA settings page in account settings - Implement TOTP-based authentication - Add MFA verification during login - Add database migration for MFA settings - Add comprehensive test coverage for MFA - Support for multiple languages - Add pyotp and qrcode dependencies > [!IMPORTANT] > > 1. Make sure you have read our [contribution guidelines](https://github.com/langgenius/dify/blob/main/CONTRIBUTING.md) > 1. Ensure there is an associated issue and you have been assigned to it > 1. Use the correct syntax to link this PR: `Fixes #<issue number>`. ## Summary This PR adds Multi-Factor Authentication (MFA) support to Dify using Time-based One-Time Password (TOTP) authentication. close https://github.com/langgenius/dify/issues/26391 This is a clean reimplementation based on PR #26112, which had become severely outdated after 2 months of upstream changes. The original PR had 86 files with many unrelated modifications and significant merge conflicts. This implementation focuses only on MFA-specific changes (46 files) and is fully compatible with the latest main branch. ### Key Features: - **TOTP Authentication**: Industry-standard time-based one-time passwords - **QR Code Setup**: Easy setup with any authenticator app (Google Authenticator, Microsoft Authenticator, etc.) - **Backup Codes**: Recovery codes for account access if device is lost - **Security Features**: Rate limiting, encrypted storage, session validation - **Full i18n Support**: Available in 20+ languages - **Optional**: MFA is disabled by default, users can opt-in ### Technical Implementation: - New MFA service layer with comprehensive security measures - Database migration for MFA settings storage - RESTful API endpoints for MFA management - React components for settings and verification - Extensive test coverage (unit, integration, security tests) ### Dependencies: - `pyotp==2.9.0` - TOTP implementation - `qrcode==7.4.2` - QR code generation ## Screenshots | Before | After | |--------|-------| | Account Settings without MFA | Account Settings with MFA option<br/>![MFA Settings Page] | | Standard login flow | Login with MFA verification step<br/>![MFA Verification] | ## Checklist - [ ] This change requires a documentation update, included: [Dify Document](https://github.com/langgenius/dify-docs) - [x] I understand that this PR may be closed in case there was no previous discussion or issues. (This doesn't apply to typos!) - [x] I've added a test for each change that was introduced, and I tried as much as possible to make a single atomic change. - [x] I've updated the documentation accordingly. - [x] I ran `dev/reformat`(backend) and `cd web && npx lint-staged`(frontend) to appease the lint gods ## Testing Instructions 1. Pull this branch and run database migrations: ```bash cd docker docker-compose up -d docker-compose exec api flask db upgrade ``` 2. Navigate to Account Settings → Multi-Factor Authentication 3. Enable MFA: - Click "Enable MFA" - Scan QR code with your authenticator app - Enter verification code - Save backup codes 4. Test login with MFA: - Log out - Log in with username/password - Enter MFA code from authenticator app 5. Test disable/re-enable flow ## Related Context - Reimplements #26112 (outdated after 2 months) - Addresses security enhancement requests for enterprise deployments - No breaking changes - fully backward compatible
yindo added the pull-request label 2026-02-21 20:49:23 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Knowledge Pipeline
Proposal
WIP
cloud
dependencies
feat:webapp
good first issue
outdated
performance
pull-request
Mirrored from GitHub Pull Request
 python:uv
refactor
size:L
stale
status: accepting prs
status: blocked
status: in discussion
stt & tts
vulnerablity
web
wont-fix
🌊 feat:workflow
🌚 invalid
🐞 bug
👻 feat:rag
💪 enhancement
📚 documentation
🔨 feat:tools
🙋‍♂️ question
🙏 help wanted
🤔 cant-reproduce
🤖 feat:agent
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langgenius/dify#31395
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?