Hi kap55,

I tried 2FA on my end and it worked.

Are you sure you are using the PkID instead of your usual login in the app ?

If so can you open an issue here so I can track it and work on it ?
https://github.com/Piwigo/piwigo-flutter-app/issues

Hi,

Piwigo NG is indeed the right app.

I tried 2FA logins with Piwigo NG 2.4.3 from Fdroid (Izzy-droid) and 2.4.2 from the Play Store.
This may be tied to your plugins but I don't understand how since darktable works.

I will try installing the same plugins tomorrow.

If possible try installing the official docker container (https://piwigo.org/guides/install/docker) and testing 2FA  if it work, this may be tied to the linuxserver container.

OK there is something strange going on here.  It may be that I am logged into the mobile app and have been all along - in fact it seems I am unable to sign out of the app.

When I logout of the app the username always defaults to guest.  That is the only name that I appear to be able to login with.  If I try to use API generated by my website I get rejected.  The app always loads my web site but I thought I was viewing as a guest however after just trying it appears I have full administrative privileges.  Even if I logout, clear the cache and uninstall the app I immediately have (without logging in) full administrative privileges after reinstalling the app.  Is this normal behaviour?

From what I can see the app continued to keep me logged in after 2FA was initiated from my main site.  I have never been able to login with API because that app will not log me out.  This is despite clearing cache and deselecting the Remember credentials switch several times.  In fact the Remember credentials switch resets itself every time I return to the login screen.

Hope I was able to explain myself sufficiently.  I am not really sure what is going on but I do believe it is a security issue if I am unable to logout from the mobile app.

erAck wrote:

kap55 wrote:

Even if I logout, clear the cache and uninstall the app I immediately have (without logging in) full administrative privileges after reinstalling the app.  Is this normal behaviour?

Maybe you have some Backup solution running on your mobile that is restoring an app's data when it is reinstalled, like Seedvault does with Automatic Restore. If so, disable that once.

Thanks for the suggestion.

I have never installed an app like Seedvault and have just reviewed all of my installed apps.  I can see nothing that would cause this type of behaviour.

I have just tried several times (again) to log out of the Piwigo mobile app/clear the cache and restart the app.  Each time it shows the sign in name as guest and automatically opens with full administrative privileges. 

I use Bitwarden to store passwords and have turned off Autofill in case that was causing problems.

Here is where things are really strange (at least to me).  If I log out of Piwigo mobile app and try to log in using a PkID/Secret Key the login fails.  If I then leave the Username and Password blank I am able to log in with full admin privileges.  This just doesn't seem right to me.

Willing to accept any help/suggestions.  Thanks.

OK I think I am finally getting somewhere...

Clearing the cache has no effect on the problem.  Clearing data did finally log me out of the app.  I was able to sign in using PkID and Key, however I am now back to the same state as before - it doesn't seem possible to logout.  If I logout and clear the cache and then open the app the PkID and Key appear and automatically log into Piwigo NG.  I have checked the settings in the app and see nothing like "Auto Login" or "Stay Logged In" that I can deselect.

FWIW I am pretty certain that even though 2FA was activated on my web site a couple of months ago it had no effect on the Piwigo NG app because I was never able to logout.  I just assumed that I was logged out and every time I entered a PkID and Key it would be rejected - because I was still logged in using my Username and Password.

Hope this explanation of my situation helps - I do think there may be a security issue with Piwigo NG.

Hi,

Happy to see it worked out for you.
I've opened an issue on github to track problem related to sessions : [Github] piwigo-flutter-app issue #257
I will try to reproduce your issue when I have the time.