{"id":25519689,"url":"https://github.com/aligent/magento2-bypass-2fa","last_synced_at":"2025-04-11T00:33:04.390Z","repository":{"id":41818800,"uuid":"464685622","full_name":"aligent/magento2-bypass-2fa","owner":"aligent","description":"Magento module allowing two-factor authentication (2FA) to be bypassed for development purposes.","archived":false,"fork":false,"pushed_at":"2023-01-16T23:29:49.000Z","size":24,"stargazers_count":6,"open_issues_count":0,"forks_count":1,"subscribers_count":9,"default_branch":"main","last_synced_at":"2025-04-02T23:46:08.465Z","etag":null,"topics":["development","magento2","security"],"latest_commit_sha":null,"homepage":"","language":"PHP","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/aligent.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2022-03-01T00:07:19.000Z","updated_at":"2025-01-24T06:58:21.000Z","dependencies_parsed_at":"2023-02-10T07:00:47.204Z","dependency_job_id":null,"html_url":"https://github.com/aligent/magento2-bypass-2fa","commit_stats":null,"previous_names":[],"tags_count":6,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aligent%2Fmagento2-bypass-2fa","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aligent%2Fmagento2-bypass-2fa/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aligent%2Fmagento2-bypass-2fa/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aligent%2Fmagento2-bypass-2fa/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/aligent","download_url":"https://codeload.github.com/aligent/magento2-bypass-2fa/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248322773,"owners_count":21084336,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["development","magento2","security"],"created_at":"2025-02-19T17:29:22.742Z","updated_at":"2025-04-11T00:33:04.371Z","avatar_url":"https://github.com/aligent.png","language":"PHP","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Bypass 2-Factor Authentication\nThis module is designed to allow developers to bypass the need for 2-factor authentication (2FA) in local development environments.\n\n### Configuration\nThe bypassing of 2FA is made possible for both admin access and the generation of admin tokens via API.\nBoth methods of access are controlled by setting variables in the environment's `app/etc/env.php` file:\n - `BYPASS_2FA_ADMIN` when set to `true` (must be a boolean, setting truthy or falsy values like 1, 'true' is not\n supported), this variable allows bypassing of 2FA for admin actions.\n - `BYPASS_2FA_API` when set to `true`, this variable allows bypassing of 2FA for admin token generation.\n\nAdditionally, there is an added security measure, to prevent 2FA being bypassed accidentally (or intentionally) in production environments.\nThe `app/etc/config.php` file must have the following config setting added under `system =\u003e default`:\n```\n'system' =\u003e [\n  'default' =\u003e [\n    'bypass_2fa' =\u003e [\n      'settings' =\u003e [\n        'allowed_hostnames' =\u003e [\n            'hostname1',\n            'hostname2',\n          ...\n        ],\n         'allowed_usernames' =\u003e [\n            'username1',\n            'username2'\n        ]\n      ]\n    ]\n  ]\n]\n```\nThe configured (partial) hostnames are checked against the base URL, with the configured name needing to be contained wholly within the base URL.\nIf no match is found, then 2FA is not bypassed for the request.\nBy committing this setting to the codebase, it prevents someone from overriding the allowed hosts in environments such as Magento Cloud hosting (where `app/etc/config.php` is not writable).\n\n### Magento Cloud\nMagento Cloud environment-specific variables can be used to switch this feature on and off on a per cloud instance, especially \nuseful for integration environments where emails may not be configured.  First make sure that you've added \nthe hostname to `config.php` in the `allowed_hostnames` section, and then also check you've added the usernames in the `allowed_usernames` section that need to be bypassed 2FA when generating the admin tokens.\nThen, in the Cloud dashboard:\n\n1. Click `Configure enviroment` and enter the `Variables` tab\n2. Add `env:BYPASS_2FA_ADMIN` and `env:BYPASS_2FA_API` as needed, setting the value to 1 to enable bypass \n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Faligent%2Fmagento2-bypass-2fa","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Faligent%2Fmagento2-bypass-2fa","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Faligent%2Fmagento2-bypass-2fa/lists"}