0

I have implemented Two factor authentication for customers.

So customer logins from frontend and if they have entered login details correct then they will be redirected to our two factor authentication page.

My question is now if user enter directly in URL http://mymagento.com/customer/account/index/ in new tab they are easily accessing their account without passing through two factor authentication.

I know to resolve this issue I need to add one more condition weather they have passed two factor auth or not. But I am not getting from where magento checks if customer session is valid or not ?

If I will get code from where Magento 2 is validating user session I will modify it, I will add one more flag in customer session 'two_factor' true/false. And I can validate it. If you have any idea from where Magento checks customer session is valid or not ?

Improve this question

1 Answer 1

Reset to default
1

I'm not sure it will helpful for you or not.

Magento check session from this file path : /var/www/html/test/vendor/magento/module-customer/CustomerData/Plugin/SessionChecker.php

From this file, Magento will delete customer session cookie if customer session expire.

There are one more file also from where session data manage : /var/www/html/test/vendor/magento/framework/Session/SessionManager.php

In this file, All activity manage of session like session start, renew, delete, check session exist or not etc.

I think you can find your answer from these files.

Improve this answer
1
  • okay Thanks for answer Rohan :) Will check and post update here
    – Dhaval Solanki
    Commented Dec 6, 2018 at 6:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.