Skip to content

Implement tracking for 2FA recovery code buttons

What does this MR do?

In !49078 (merged) the 2FA recovery codes flow was improved by adding copy, download, and print buttons. One of these buttons needs to be clicked before the "Proceed" button becomes active. This will hopefully encourage users to save their 2FA recovery codes.

To complete the last bullet in #267730 (closed) this MR adds Snowplow tracking for all of the buttons.

Screenshots (strongly suggested)

Copy button

Screen_Shot_2020-12-08_at_12.10.20_PM

Download button

Screen_Shot_2020-12-08_at_12.10.30_PM

Print button

Screen_Shot_2020-12-08_at_12.10.39_PM

Proceed button

Screen_Shot_2020-12-08_at_12.11.03_PM

Manually copy with keyboard shortcut

Screen_Shot_2020-12-08_at_12.10.51_PM

Local testing

  1. Enable vue_2fa_recovery_codes feature flag
    • bin/rails console
    • Feature.enable(:vue_2fa_recovery_codes)
  2. Install Snowplow analytics debugger extension
  3. Navigate to /-/profile/account
  4. Click "Enable two-factor authentication"
  5. Open up 1Password
  6. Click + icon and then "Login"
  7. Create a new "One-Time Password" section
    • Screen_Shot_2020-12-03_at_11.33.49_AM
  8. Click the QR icon left of the dropdown that was just used
  9. Drag the QR window over the QR code
  10. Paste the OTP in the "Pin code" field and click "Register with two-factor app"
  11. Open up dev tools and click "Snowplow Analytics Debugger" tab
  12. Click any of the buttons, the tracking event should show in the dev tools

Lock yourself out of GDK by accident?

No need to panic, I did this a bunch of times 😆

  1. bin/rails console
  2. user = User.find(1) (or whatever ID your user is, default admin is 1)
  3. TwoFactor::DestroyService.new(user, user: user).execute

Does this MR meet the acceptance criteria?

Conformity

Availability and Testing

Security

If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

  • [-] Label as security and @ mention @gitlab-com/gl-security/appsec
  • [-] The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • [-] Security reports checked/validated by a reviewer from the AppSec team
Edited by Peter Hegman

Merge request reports