Exclude 2FA from upload#show routes and 404s

Catalin Irimie requested to merge cat-2fa-regen-redirect into master

What does this MR do?

As seen in #247461 (closed), nonexistent routes should not redirect to the 2FA page, as there can be missing resources, which would cause the 2FA secret to be regenerated

For UploadsController#show routes, any resource trying to be loaded while on the 2FA page (avatar, custom header etc) would redirect to the 2FA page, also regenerating the token after the QR/key was already rendered in the view.

This skips the 2FA check for UploadsController#show routes and ApplicationController#route_not_found ones. The latter is correct, but the UploadsController#show may not be the best idea from a security p.o.v. - it would allow users with enforced 2FA to still view uploads if they had a direct link.

WDYT @dblessing @mksionek?


Does this MR meet the acceptance criteria?


Availability and Testing


If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

  • Label as security and @ mention @gitlab-com/gl-security/appsec
  • The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • Security reports checked/validated by a reviewer from the AppSec team

Merge request reports