2FA: Proposal - Use inputmode=numeric on OTP input fields

Problem description:

When inputting the OTP at least on iOS the normal keyboard pops up.

I propose to use the inputmode=numeric parameter for the inputfield so the numeric keyboard automatically pops up. Thats makes it easier to type the OTP in.

Actual Behaviour:

Expected Behaviour:

mentioned in issue gitlab-org/quality/triage-reports#10 (closed)

mentioned in issue gitlab-org/quality/triage-reports#11 (closed)

added 2FA frontend security labels

added authentication devopsmanage groupauthentication and authorization [DEPRECATED] labels

added typefeature label

@senk our recovery codes are alphanumeric, so we should avoid doing this if it would prohibit letter entry.

Recovery codes are likely to be copy-pasted in, so if this is just a hint that gives a handy control for typing a code in manually, and the control will still accept letters, that's probably ok.

Most of the authenticator apps does not allow copy & paste, therefore you are must to manually type the code.

Most of the authenticator apps does not allow copy & paste,

I don't believe this is the case anymore. In my experience, I've been able to copy codes from Google Authenticator and Authy.

mentioned in issue #208611 (closed)

mentioned in issue #209696 (closed)

mentioned in issue #211271 (closed)

mentioned in issue #212096 (closed)

mentioned in issue #212789 (closed)

mentioned in issue #212802 (closed)

mentioned in issue #213477 (closed)

mentioned in issue #214168 (closed)

mentioned in issue #214939 (closed)

mentioned in issue #215805 (closed)

mentioned in issue #216400 (closed)

marked #216387 (closed) as a duplicate of this issue

marked this issue as related to #216387 (closed)

mentioned in issue #216387 (closed)

added 1 deleted label

How do I check if someone is working on this issue? if not, I would like to :)

added sectiondev label

@peterhegman could you weight this issue?

@ogolowinski @peterhegman I tested inputmode=numeric on Android and it doesn't allow me to enter in letters, so I don't think this is a good solution in the case a user needs to use their recovery codes.

Thanks @dennis, Do you have an alternative proposal?

Is recovery codes the same screen?

Also could we toggle between numerical and alphabetical?

@ogolowinski

Do you have an alternative proposal?

No, I believe we should leave this as-is.

Is recovery codes the same screen?

Yes. It's indicated in the copy in the screenshot in the issue description.

Also could we toggle between numerical and alphabetical?

No, as I mentioned, you're not able to toggle back to alphabetical if you use the proposal as defined.

Yeah I agree with @dennis. We actually tried to do this a while back in !22868 (merged) and it ended up causing a regression. There is also #198352 which proposes splitting up the OTP and recovery code screens and would allow us to make the OTP field numeric only. That will be quite a bit larger lift though and will require some backend work.

@peterhegman @ogolowinski I think we should close this issue in favor of #198352

I agree. Thank you @dennis @peterhegman. We will not pursue this issue

mentioned in issue gitlab-org/manage/general-discussion#17374

added workflowplanning breakdown label

closed