UNITRONIX a0a15261dc fix(rustdesk-api): add RUSTDESK_API_DISABLE_TOTP opt-in flag (#104) ...

Stock RustDesk OSS clients (v1.4.6 and earlier) do not implement the
`tfa_check` response shape returned by /api/login when a user has
TOTP enabled — they reject it as 'bad response from server', leaving
2FA-protected accounts unable to log in from the desktop client.

Add an opt-in env flag RUSTDESK_API_DISABLE_TOTP (default false). When
true, /api/login on the dedicated RustDesk client API port (:21121)
skips TOTP enforcement and issues an access token directly after
password authentication. The web panel routes still enforce TOTP
independently — this change is scoped to the RustDesk-compatible
endpoint only.

Each bypass is audit-logged as 'api_login_success_totp_bypassed' and
emits a console warning so operators can monitor usage.

Refs #104

2026-04-26 00:44:00 +02:00

..

config.js

fix(rustdesk-api): add RUSTDESK_API_DISABLE_TOTP opt-in flag (#104)

2026-04-26 00:44:00 +02:00