[Browser MFA] Add protobuf and config by danielashare · Pull Request #63831 · gravitational/teleport

danielashare · 2026-02-16T11:52:55Z

This PR adds protobuf and the configuration for enabling Browser MFA. The RFD for these additions can be found here.

Manual tests:

Browser MFA enabled by default when WebAuthn enabled
Browser MFA disabled by default when WebAuthn disabled
Error emitted when Browser MFA explicitly enabled and WebAuthn disabled

bl-nero · 2026-02-17T13:54:45Z

+message ValidateBrowserMFAChallengeResponse {
+  // tsh_redirect_url is the callback URL to tsh's local HTTP server with the encrypted WebAuthn response.
+  // Format: http://127.0.0.1:[random_port]/callback?response={encrypted_webauthn_response}
+  string tsh_redirect_url = 1;


I don't think it was mentioned in the RFD, but will there be any protection against creating an open-redirect logic on the web frontend side?

I wasn't planning on adding redirect validation on the web frontend because the redirect url is accepted once from the user at the start of the ceremony and validated by ValidateClientRedirect. The URL is then stored on the backend waiting for the user to MFA in the browser. After doing so, the auth server encrypts the WebAuthn response and adds it to the stored and validated redirect URL for returning to the browser.

bl-nero · 2026-02-17T13:59:05Z

+  // AllowBrowserAuthentication enables/disables browser-based authentication.
+  // When set to false, authentication flows that require a browser will be disabled.
+  // Defaults to true.


The way it's phrased suggests that any kind of local login (including regular sign-ins to the web app) would be gated by this option. Is that the case? If not, the documentation should be a bit more clear that we're only talking about the browser MFA flow for tsh.

That is not the case, this is only available to CLI tools. I'll make sure this is clearer in this comment and in documentation.

bl-nero · 2026-02-17T14:09:09Z

  string proxy_address_for_sso = 4;
+  // Used to construct the redirect URL for browser-based MFA flows. If the client supports browser MFA, this field
+  // should be set to the URL where the browser should redirect to tsh after completing the MFA challenge.
+  string browser_mfa_tsh_redirect_url = 5;


Will this URL be validated by the auth server?

Yes, this will also be validated by ValidateClientRedirect on the server side

bl-nero · 2026-02-17T14:14:21Z

  // per-session MFA but we may still need to know that the user has TOTP
  // configured as an option.
  bool per_session_mfa = 7;
+  BrowserMFAChallenge browser = 8;


What's the role of this field? I also see it mentioned in the RFD, but I don't understand how this all relates to teleterm.

When a user initiates a request in teleterm that requires MFA, a request is sent by tsh daemon to Teleport and Teleport replies with the available challenges. The daemon will then create this PromptMFARequest message and forward it to teleterm, which will then show a modal for the user to choose their method of MFA. So this field just lets teleterm know that Browser MFA is an MFA option

github-actions · 2026-02-18T09:37:04Z

Amplify deployment status

Branch	Commit	Job ID	Status	Preview	Updated (UTC)
danielashare/browser-mfa-proto	`8a5561b`	14	✅SUCCEED	danielashare-browser-mfa-proto	2026-03-02 07:45:42

codingllama · 2026-02-19T14:04:11Z

+	case c.Spec.AllowBrowserAuthentication == nil:
+		// Materialize AllowBrowserAuthentication to true if WebAuthn is enabled,
+		// otherwise leave it nil.
+		if hasWebauthn {
+			c.Spec.AllowBrowserAuthentication = NewBoolOption(true)
+		}


Suggested change

case c.Spec.AllowBrowserAuthentication == nil:

// Materialize AllowBrowserAuthentication to true if WebAuthn is enabled,

// otherwise leave it nil.

if hasWebauthn {

c.Spec.AllowBrowserAuthentication = NewBoolOption(true)

}

case hasWebauthn && c.Spec.AllowBrowserAuthentication == nil:

// Materialize AllowBrowserAuthentication to true if WebAuthn is enabled,

// otherwise leave it nil.

c.Spec.AllowBrowserAuthentication = NewBoolOption(true)

It also occurs to me that we could never materialize and always calculate on the fly. Maybe add a variant of GetAllowBrowserAuthentication() that does that, so the logic is all captured here.

Friendly ping?

Sounds good to me, left a validation check in CheckAndSetDefaults and calculate the rest on the fly in the getter

codingllama · 2026-02-19T14:09:15Z

Looks good, a few minor comments only.

Improve comments grpc, lint, test fix Update tf docs Update tf integration Fix login test Address comments Fix test Move ValidateBrowserMFAChallenge rpc to MFA service Fix service test Address comments Don't materialise browser authentication Remove browser auth materialisation in test Convert validate browser mfa to complete browser mfa

backport-bot-workflows · 2026-03-02T09:09:45Z

@danielashare See the table below for backport results.

Branch	Result
branch/v18	Failed

Improve comments grpc, lint, test fix Update tf docs Update tf integration Fix login test Address comments Fix test Move ValidateBrowserMFAChallenge rpc to MFA service Fix service test Address comments Don't materialise browser authentication Remove browser auth materialisation in test Convert validate browser mfa to complete browser mfa

[Browser MFA] Add protobuf and config (#63831) [Browser MFA] Add proto for Browser MFA feature (#64048) [Browser MFA] Add CompleteBrowserMFAChallenge gRPC (#63873) [Browser MFA] Rename browser mfa config name (#64980) [Browser MFA] Add BrowserMFARequestID to CreateAuthenticateChallenge (#63945) [Browser MFA] Add Browser MFA to challenge request flow (#63936) [Browser MFA] Add initial requests for browser MFA process to client tools (#64301) [Browser MFA] Add tsh callback handling for webauthn response (#64461) [Browser MFA] Add Browser MFA to presence checks (#65052) [Browser MFA] Add browser MFA path to MFA finish flow (#64523) [Browser MFA] Add Browser MFA to Connect (#64887) [Browser MFA] Add Browser MFA UI (#64692) [Browser MFA] Fix formatting in moderated sessions (#65236) [Browser MFA] Add Browser MFA ceremony tests

[Browser MFA] Add protobuf and config (gravitational#63831) [Browser MFA] Add proto for Browser MFA feature (gravitational#64048) [Browser MFA] Add CompleteBrowserMFAChallenge gRPC (gravitational#63873) [Browser MFA] Rename browser mfa config name (gravitational#64980) [Browser MFA] Add BrowserMFARequestID to CreateAuthenticateChallenge (gravitational#63945) [Browser MFA] Add Browser MFA to challenge request flow (gravitational#63936) [Browser MFA] Add initial requests for browser MFA process to client tools (gravitational#64301) [Browser MFA] Add tsh callback handling for webauthn response (gravitational#64461) [Browser MFA] Add Browser MFA to presence checks (gravitational#65052) [Browser MFA] Add browser MFA path to MFA finish flow (gravitational#64523) [Browser MFA] Add Browser MFA to Connect (gravitational#64887) [Browser MFA] Add Browser MFA UI (gravitational#64692) [Browser MFA] Fix formatting in moderated sessions (gravitational#65236) [Browser MFA] Add Browser MFA ceremony tests

danielashare self-assigned this Feb 16, 2026

danielashare added the no-changelog Indicates that a PR does not require a changelog entry label Feb 16, 2026

github-actions Bot requested review from bl-nero and ravicious February 16, 2026 11:53

github-actions Bot added the size/md label Feb 16, 2026

danielashare force-pushed the danielashare/browser-mfa-proto branch from 8e9cfa5 to f5df2e4 Compare February 16, 2026 12:12

danielashare requested review from Joerger and codingllama February 17, 2026 10:11

danielashare added the backport/branch/v18 label Feb 17, 2026

danielashare mentioned this pull request Feb 17, 2026

[Browser MFA] Add CompleteBrowserMFAChallenge gRPC #63873

Merged

7 tasks

bl-nero reviewed Feb 17, 2026

View reviewed changes

danielashare temporarily deployed to docs-amplify February 18, 2026 09:35 — with GitHub Actions Inactive

danielashare temporarily deployed to docs-amplify February 18, 2026 10:29 — with GitHub Actions Inactive

danielashare temporarily deployed to docs-amplify February 18, 2026 10:52 — with GitHub Actions Inactive

danielashare mentioned this pull request Feb 18, 2026

[Browser MFA] Add Browser MFA to challenge request flow #63936

Merged

4 tasks

codingllama reviewed Feb 18, 2026

View reviewed changes

danielashare mentioned this pull request Feb 18, 2026

[Browser MFA] Add BrowserMFARequestID to CreateAuthenticateChallenge #63945

Merged

3 tasks

danielashare temporarily deployed to docs-amplify February 18, 2026 21:29 — with GitHub Actions Inactive

danielashare temporarily deployed to docs-amplify February 19, 2026 07:30 — with GitHub Actions Inactive

danielashare temporarily deployed to docs-amplify February 19, 2026 07:54 — with GitHub Actions Inactive

danielashare temporarily deployed to docs-amplify February 19, 2026 09:35 — with GitHub Actions Inactive

codingllama reviewed Feb 19, 2026

View reviewed changes

Comment thread proto/teleport/lib/teleterm/v1/tshd_events_service.proto Outdated

This was referenced Feb 19, 2026

[Browser MFA] Split validation out of Finish function #63978

Closed

Browser MFA Feature #63987

Open

danielashare temporarily deployed to docs-amplify February 20, 2026 14:14 — with GitHub Actions Inactive

codingllama approved these changes Feb 23, 2026

View reviewed changes

danielashare mentioned this pull request Feb 23, 2026

[Browser MFA] Add proto for Browser MFA feature #64048

Merged

bl-nero approved these changes Feb 25, 2026

View reviewed changes

danielashare force-pushed the danielashare/browser-mfa-proto branch from e08f5d2 to 55869d8 Compare February 26, 2026 23:29

danielashare temporarily deployed to docs-amplify February 26, 2026 23:29 — with GitHub Actions Inactive

public-teleport-github-review-bot Bot removed request for Joerger and ravicious February 26, 2026 23:30

danielashare temporarily deployed to docs-amplify February 28, 2026 02:30 — with GitHub Actions Inactive

danielashare force-pushed the danielashare/browser-mfa-proto branch from 2c63567 to 8ea0de0 Compare February 28, 2026 02:49

danielashare temporarily deployed to docs-amplify February 28, 2026 02:50 — with GitHub Actions Inactive

danielashare force-pushed the danielashare/browser-mfa-proto branch from 8ea0de0 to 0cb377a Compare February 28, 2026 03:16

danielashare temporarily deployed to docs-amplify February 28, 2026 03:16 — with GitHub Actions Inactive

danielashare force-pushed the danielashare/browser-mfa-proto branch from 0cb377a to 8a5561b Compare March 2, 2026 07:40

danielashare temporarily deployed to docs-amplify March 2, 2026 07:40 — with GitHub Actions Inactive

danielashare added this pull request to the merge queue Mar 2, 2026

github-merge-queue Bot removed this pull request from the merge queue due to failed status checks Mar 2, 2026

danielashare added this pull request to the merge queue Mar 2, 2026

Merged via the queue into master with commit 36120b3 Mar 2, 2026
47 checks passed

danielashare deleted the danielashare/browser-mfa-proto branch March 2, 2026 09:08

danielashare added a commit that referenced this pull request Mar 31, 2026

[Browser MFA] Add protobuf and config (#63831)

6ca6482

danielashare added a commit that referenced this pull request Apr 2, 2026

[Browser MFA] Add protobuf and config (#63831)

eb58ecf

danielashare added a commit that referenced this pull request Apr 7, 2026

[Browser MFA] Add protobuf and config (#63831)

8e0551b

danielashare added a commit that referenced this pull request Apr 17, 2026

[Browser MFA] Add protobuf and config (#63831)

797592c

danielashare added a commit that referenced this pull request Apr 30, 2026

[Browser MFA] Add protobuf and config (#63831)

020149b

danielashare added a commit that referenced this pull request May 5, 2026

[Browser MFA] Add protobuf and config (#63831)

e38b56c

Conversation

danielashare commented Feb 16, 2026

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Feb 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

codingllama commented Feb 19, 2026

Uh oh!

Uh oh!

Uh oh!

backport-bot-workflows Bot commented Mar 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

github-actions Bot commented Feb 18, 2026 •

edited

Loading