[Browser MFA] Add Browser MFA UI by danielashare · Pull Request #64692 · gravitational/teleport

danielashare · 2026-03-16T17:07:22Z

This PR adds the UI for the Browser MFA feature. The RFD for this feature can be found here. Tracking issue #63987.

These changes address this part of the flow from the above RFD (with the Auth interactions cut out for brevity):

sequenceDiagram
    participant tsh
    participant browser as Browser
    participant proxy as Proxy

    tsh->>browser: Open browser to:<br/>https://teleport.example.com/web/mfa/browser/:request_id
    activate browser

    browser->>proxy: GET /web/mfa/browser/:request_id
    proxy->>browser: Render MFA page
    browser->>proxy: POST /webapi/mfa/authenticatechallenge<br/>w/ browser_mfa_request_id
    proxy->>browser: MFA Challenge
    browser-->>browser: Display WebAuthn prompt
    browser->>browser: User taps TouchID /<br/>Uses password manager passkey
    browser->>proxy: PUT /webapi/mfa/browser/:request_id
  
    proxy-->>browser: HTTP 200 with redirect URL

    browser->>tsh: Redirect to callback URL<br/>http://127.0.0.1:port/callback?response={encrypted_webauthn}
    deactivate browser

Quick demo: https://github.com/user-attachments/assets/eea50890-e4fb-4e65-9dd8-4151634bd252

Manual Test Plan

Test Environment

UI tested on a Teleport instance running this branch locally, with backend requests being sent to a Teleport instance that has Browser MFA server-side changes (danielashare/tsh-browser-mfa-sso). SSO supported by a local keycloak instance.

Test Cases

Browser MFA login happy path
- tsh opens /web/mfa/browser/:requestId
- MFA prompt shows
- After completing MFA, user is redirected to tsh
- tsh is logged in
Missing request ID shows error
Using a fake request ID shows access denied
Injecting a redirect URL of baddomain.com is caught by local validation
SSO login and MFA is unaffected

kimlisa · 2026-03-16T19:51:14Z

is there a missing PR in the description that is required to test this myself? b/c i wasn't able to make it work. ( i checked out this branch, re-built teleport and tsh)

danielashare · 2026-03-17T13:56:57Z

is there a missing PR in the description that is required to test this myself? b/c i wasn't able to make it work. ( i checked out this branch, re-built teleport and tsh)

Sorry about that @kimlisa, the (mainly PoC, doesn't have tests etc) PR is compiled together on danielashare/tsh-browser-mfa-sso. So you can run that as the backend and build tsh from it, then just run the frontend from this branch. Only catch is when tsh opens the browser mfa page, you'll have to modify the URL to point to the frontend rather than the PoC branch

zmb3

Just styling nits.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 77d83b13b0

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 10fc7fd8a5

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6ccb634ba2

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d6ae2176b3

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2430eb4851

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0dbbaaddb5

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 46b7b4d874

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6a4d155cce

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

zmb3 · 2026-03-29T15:26:12Z

+
+import { validateClientRedirect } from '../../../shared/redirects/urlValidation';
+
+interface BrowserMFAProps {


Suggested change

interface BrowserMFAProps {

interface BrowserMfaProps {

I know it's tough when switching between frontend and backend, but we only use all caps in the Go code.

It'll sink in one day 🤦‍♂️ cheers

chatgpt-codex-connector · 2026-03-30T14:14:20Z

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.

chatgpt-codex-connector · 2026-03-30T15:10:02Z

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.

chatgpt-codex-connector · 2026-03-30T20:18:37Z

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.

backport-bot-workflows · 2026-03-30T20:59:55Z

@danielashare See the table below for backport results.

Branch	Result
branch/v18	Failed

[Browser MFA] Add protobuf and config (#63831) [Browser MFA] Add proto for Browser MFA feature (#64048) [Browser MFA] Add CompleteBrowserMFAChallenge gRPC (#63873) [Browser MFA] Rename browser mfa config name (#64980) [Browser MFA] Add BrowserMFARequestID to CreateAuthenticateChallenge (#63945) [Browser MFA] Add Browser MFA to challenge request flow (#63936) [Browser MFA] Add initial requests for browser MFA process to client tools (#64301) [Browser MFA] Add tsh callback handling for webauthn response (#64461) [Browser MFA] Add Browser MFA to presence checks (#65052) [Browser MFA] Add browser MFA path to MFA finish flow (#64523) [Browser MFA] Add Browser MFA to Connect (#64887) [Browser MFA] Add Browser MFA UI (#64692) [Browser MFA] Fix formatting in moderated sessions (#65236) [Browser MFA] Add Browser MFA ceremony tests

[Browser MFA] Add protobuf and config (gravitational#63831) [Browser MFA] Add proto for Browser MFA feature (gravitational#64048) [Browser MFA] Add CompleteBrowserMFAChallenge gRPC (gravitational#63873) [Browser MFA] Rename browser mfa config name (gravitational#64980) [Browser MFA] Add BrowserMFARequestID to CreateAuthenticateChallenge (gravitational#63945) [Browser MFA] Add Browser MFA to challenge request flow (gravitational#63936) [Browser MFA] Add initial requests for browser MFA process to client tools (gravitational#64301) [Browser MFA] Add tsh callback handling for webauthn response (gravitational#64461) [Browser MFA] Add Browser MFA to presence checks (gravitational#65052) [Browser MFA] Add browser MFA path to MFA finish flow (gravitational#64523) [Browser MFA] Add Browser MFA to Connect (gravitational#64887) [Browser MFA] Add Browser MFA UI (gravitational#64692) [Browser MFA] Fix formatting in moderated sessions (gravitational#65236) [Browser MFA] Add Browser MFA ceremony tests

danielashare self-assigned this Mar 16, 2026

danielashare added no-changelog Indicates that a PR does not require a changelog entry backport/branch/v18 labels Mar 16, 2026

github-actions Bot requested review from charlestp and kimlisa March 16, 2026 17:07

github-actions Bot added size/md ui labels Mar 16, 2026

danielashare mentioned this pull request Mar 16, 2026

Browser MFA Feature #63987

Open

zmb3 reviewed Mar 17, 2026

View reviewed changes

chatgpt-codex-connector Bot reviewed Mar 23, 2026

View reviewed changes

Comment thread web/packages/teleport/src/BrowserMFA/BrowserMFA.tsx

chatgpt-codex-connector Bot reviewed Mar 23, 2026

View reviewed changes

Comment thread web/packages/teleport/src/services/auth/auth.ts

Comment thread web/packages/teleport/src/BrowserMFA/BrowserMFA.tsx

danielashare commented Mar 23, 2026

View reviewed changes

Comment thread web/packages/teleport/src/BrowserMFA/BrowserMFA.tsx Outdated

chatgpt-codex-connector Bot reviewed Mar 23, 2026

View reviewed changes

Comment thread web/packages/teleport/src/services/auth/auth.ts

Comment thread web/packages/teleport/src/services/auth/auth.ts

chatgpt-codex-connector Bot reviewed Mar 23, 2026

View reviewed changes

Comment thread web/packages/teleport/src/Teleport.tsx Outdated

chatgpt-codex-connector Bot reviewed Mar 24, 2026

View reviewed changes

Comment thread web/packages/teleport/src/BrowserMFA/BrowserMFA.tsx Outdated

chatgpt-codex-connector Bot reviewed Mar 25, 2026

View reviewed changes

Comment thread web/packages/teleport/src/services/auth/auth.ts

Comment thread web/packages/teleport/src/services/auth/auth.ts

danielashare requested a review from avatus March 26, 2026 18:00

avatus reviewed Mar 26, 2026

View reviewed changes

Comment thread web/packages/teleport/src/BrowserMFA/BrowserMFA.tsx Outdated

Comment thread web/packages/teleport/src/BrowserMFA/BrowserMFA.tsx

Comment thread web/packages/shared/redirects/urlValidation.ts

Comment thread web/packages/teleport/src/config.ts

avatus approved these changes Mar 27, 2026

View reviewed changes

chatgpt-codex-connector Bot reviewed Mar 27, 2026

View reviewed changes

Comment thread web/packages/teleport/src/BrowserMFA/BrowserMFA.tsx

chatgpt-codex-connector Bot reviewed Mar 28, 2026

View reviewed changes

Comment thread web/packages/teleport/src/BrowserMFA/BrowserMFA.tsx

danielashare force-pushed the danielashare/browser-mfa-ui branch from 6a4d155 to f21d51d Compare March 28, 2026 20:20

zmb3 reviewed Mar 29, 2026

View reviewed changes

danielashare force-pushed the danielashare/browser-mfa-ui branch from 41c2ec9 to 8b393a2 Compare March 30, 2026 15:09

kimlisa approved these changes Mar 30, 2026

View reviewed changes

public-teleport-github-review-bot Bot removed the request for review from charlestp March 30, 2026 17:17

[Browser MFA] Add Browser MFA UI

6c6f691

danielashare force-pushed the danielashare/browser-mfa-ui branch from 8b393a2 to 6c6f691 Compare March 30, 2026 20:18

danielashare added this pull request to the merge queue Mar 30, 2026

Merged via the queue into master with commit 072110c Mar 30, 2026
43 checks passed

danielashare deleted the danielashare/browser-mfa-ui branch March 30, 2026 20:58

danielashare added a commit that referenced this pull request Mar 31, 2026

[Browser MFA] Add Browser MFA UI (#64692)

4de5bed

danielashare added a commit that referenced this pull request Apr 2, 2026

[Browser MFA] Add Browser MFA UI (#64692)

f7d9bb2

danielashare added a commit that referenced this pull request Apr 7, 2026

[Browser MFA] Add Browser MFA UI (#64692)

f7f354d

danielashare added a commit that referenced this pull request Apr 17, 2026

[Browser MFA] Add Browser MFA UI (#64692)

61ad8fd

mmcallister pushed a commit that referenced this pull request Apr 24, 2026

[Browser MFA] Add Browser MFA UI (#64692)

bcaa635

mmcallister pushed a commit that referenced this pull request Apr 28, 2026

[Browser MFA] Add Browser MFA UI (#64692)

1363862

danielashare added a commit that referenced this pull request Apr 30, 2026

[Browser MFA] Add Browser MFA UI (#64692)

adf692e

danielashare added a commit that referenced this pull request May 5, 2026

[Browser MFA] Add Browser MFA UI (#64692)

2f6dcde


		import { validateClientRedirect } from '../../../shared/redirects/urlValidation';

		interface BrowserMFAProps {

Conversation

danielashare commented Mar 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Manual Test Plan

Test Environment

Test Cases

Uh oh!

kimlisa commented Mar 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

danielashare commented Mar 17, 2026

Uh oh!

zmb3 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

zmb3 Mar 29, 2026

Choose a reason for hiding this comment

Uh oh!

danielashare Mar 30, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot commented Mar 30, 2026

Uh oh!

chatgpt-codex-connector Bot commented Mar 30, 2026

Uh oh!

chatgpt-codex-connector Bot commented Mar 30, 2026

danielashare commented Mar 16, 2026 •

edited

Loading

kimlisa commented Mar 16, 2026 •

edited

Loading