Manually lock an account in Devise

Question

I have set up 2-factor authentication and I also have lockable activated in devise (with 10 minute timeout).

The lockable works fine, but I want it to work for the 2fa code too.

2 questions with this:

• Can I use the counter in devise to be increase when a wrong tfa code is entered? Or would this reset because for Devise the user is already signed in. (I use the 2fa by doing a before_action in the ApplicationController.
• If I can't use the Devise counter I'll save the failed attempts in the session, how can I manually lock a user after X wrong attempts?

Answer 1

Part 1: You could look at adding a new column to the user model to track the # of 2FA attempts and tick that up. But you run into a LOT of what-ifs almost immediately. What if they stop, come back, re-authenticate properly? Make sure to reset that count so it doesn't fail them faster next time, for one example.

Part 2: Manually locking is done with lock_access! call on the user instance variable.