[5.x]: Unable to log into Control Panel - No authentication form has been registered for the method "craft\auth\methods\TOTP"

[LauraMontgomery]

What happened?

After enabling 2FA on a new Craft 5 site, and after my session timed out and I was automatically logged out, I have been unable to log back in.

I am getting a 403 on https://www.development-website.com/index.php?p=mf-admin/actions/app/resource-js&url=https://cdn.development-website.com/cpresources/eefccc45/totp.js?v=1714491585

And the error message

Uncaught (in promise) No authentication form has been registered for the method "craft\auth\methods\TOTP". LoginForm.js:2

I was able to find the error No authentication form has been registered for the method in
/vendor/craftcms/cms/src/web/assets/cp/dist/cp.js.map

CP Resources cache has been cleared, and site has been redeployed to staging environment to generate a new set of CP Resources, but the issue persists.

Craft CMS version

5.0.6

PHP version

8.2.18

Operating system and version

Linux 6.3.13-linuxkit

Database type and version

MariaDB 10.4.22

Image driver and version

Imagick 3.7.0 (ImageMagick 7.1.1-26)

Installed plugins and versions

• Amazon S3 2.2.1
• CKEditor 4.0.4
• Scout 5.0.0-beta.1

[i-just]

Hi, thanks for reaching out!

I think the main culprit here is going to be the 403 error when trying to load the totp.jsfile. If that file cannot be loaded, the No authentication form has been registered for the method is triggered.

Did you verify if you're able to view the contents of https://www.development-website.com/index.php?p=mf-admin/actions/app/resource-js&url=https://cdn.development-website.com/cpresources/eefccc45/totp.js?v=1714491585?

[LauraMontgomery]

Hello!

So if I try to visit https://www.[development-site].com/index.php?p=mf-admin/actions/app/resource-js&url=https://cdn.[development-site].com/cpresources/5c7cef49/totp.js?v=1714571154 I get redirected to the login page.

If I view the response in the console when trying to login, I can see the error message

Unauthorised
Login Required

I am able to view the totp.js file by visiting https://cdn.[development-site].com/cpresources/5c7cef49/totp.js?v=1714571154

So, maybe there is something in how the action is calling it...?

I notice that 5.1.0 is available, so I will run that update and see if that resolves the problem. I'll let you know either way.

Thanks!

[LauraMontgomery]

So, the update to 5.1.0 did not fix the issue. But by removing 2FA as a required setting, apply project config, then clearing out the authenticator table so that 2FA wasn't still applied to the Admin account, I can now login

I know it doesn't actually fix the issue, but let's me at least carry on with development

Not sure if it helps with pointing roughly where the issue has come in? Hopefully it helps anyway

[brandonkelly]

Hey @LauraMontgomery, in config/general.php, are you:

• Setting the resourceBaseUrl config setting?
• Setting the @web alias, via the aliases config setting?

[LauraMontgomery]

Thanks @brandonkelly I've been chatting to other devs on my team and we've tested / found out a couple more things this morning. To answer your questions:

1. we are setting the @web alias to our primary site URL.
2. we are setting resourceBaseUrl (in a module, not general.php) to our Cloudfront CDN URL https://cdn.development-website.com/cpresources. The module sets all the appropriate CORS headers etc. and appears to work well on regular non-2FA installs.

By disabling the remote cp resources module and setting up a test admin user with 2FA, I was able to login. When I re-enabled the module and I run into the same issue.

Another developer on my team has a hunch that the actionResourceJs controller action is not allowAnonymous, so it's failing to get the totp.js asset because we're not logged in yet

[brandonkelly]

Another developer on my team has a hunch that the actionResourceJs controller action is not allowAnonymous, so it's failing to get the totp.js asset because we're not logged in yet

Ah, I think that’s it. Just opened that controller action up to anonymous requests, for the next release. I’ll ping you once that’s tagged.

[brandonkelly]

Craft 4.9.1 and 5.1.1 are out with that fix. Let me know if it helps!

[LauraMontgomery]

Amazing! Thank you Brandon. I've ran that update and can now login with my test 2FA admin account. Thanks for pushing the fix so quickly :)

[brandonkelly]

Awesome, thanks for letting me know!