MFA Enabled: "Last Logged In" Timestamp Behaviour

Hello Passbolt Team :wave:t2:

I hope you’re doing well.

I have noticed that while MFA is enabled for all users, the “Last logged in” time is being updated as soon as a user enters their passphrase and clicks the “Sign in” button. This occurs before they enter their 6-digit MFA code.

In my view, when MFA is enabled, the “Last logged in” time should only be updated after the MFA code has been successfully entered and verified.

Could you please confirm if this behavior is expected, or if adjustments could be made to align the login timestamp with MFA validation?

Thank you for your time.

Server 4.9.1 / Client 4.9.2

Hello @sneaker-net, thanks for your valuable feedback !

You are right, I confirm that the “Last logged in” is updated when the user hit “Sign-In”.

AFAIK, I don’t think there is any workaround for that. I have created an internal ticket for this (ref. PB-35324) in order to potentially investigate what could be the reason behind that.

Regarding the investigation and a potential implementation, I can’t give any ETA since it doesn’t seem like a blocker, so I am not sure if it will be tackle anytime soon by development team as they are currently working on the v5 (if you haven’t been teased yet :eyes:) but if we have more information about it or if there is any workaround we will let you know! :slight_smile:

Thanks again.

Best regards

1 Like

Hi @antony, thank you for looking into this and for creating an internal ticket to investigate further. I understand that it may not be prioritised given the current focus on v5 dev. I appreciate your transparency regarding the timeline.

Please keep me updated if any progress is made or if a workaround becomes available.