2FA not prompted on package upload?

[vidartf]

Describe the bug
After having just enabled 2FA on the test server, I tried uploading a new package with twine upload --repository-url https://test.pypi.org/legacy/ dist/*. I was prompted for username and password as normal, and it then uploaded the packages successfully. It never prompted for a 2FA key.

Expected behavior
Either it should prompt for a 2FA key, or it should fail.

My Platform

• Windows 10
• twine version 1.13.0 (pkginfo: 1.5.0.1, requests: 2.21.0, setuptools: 40.6.3, requests-toolbelt: 0.9.1, tqdm: 4.31.1)

Xref #5661

[alex]

This is a known behavior. The solution here is that we're going to be moving to API keys for uploads.

[vidartf]

Thanks for the reply. Not entirely sure what is meant by an API key (https://stackoverflow.com/questions/1453073/what-is-an-api-key#1453082). Is this some long lasting token, or a one-time key?

[alex]

It's a long time key, with restricted privs -- there's a bug for it, but I'm on my phone so I can't easily access it, sorry!

…

On Wed, May 8, 2019, 7:24 PM Vidar Tonaas Fauske ***@***.***> wrote: Thanks for the reply. Not entirely sure what is meant by an API key ( https://stackoverflow.com/questions/1453073/what-is-an-api-key#1453082). Is this some long lasting token, or a one-time key? — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#5815 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAAAGBH7SHBA7IVHL6BFMJTPUNOK3ANCNFSM4HLNMGTQ> .

[jezdez]

The issue in question is #994.

[vidartf]

Neat. So I assume that means 2FA push to prod is blocked on #994, and that uploads through any route will fail if:

• 2FA is enabled.
• No 2FA-circumventing token is used.

Will there be a non-browser upload method supporting 2FA?

[woodruffw]

Will there be a non-browser upload method supporting 2FA?

Probably not. We discussed some schemes early on that would allow users to embed e.g. a TOTP token alongside their password, but the ultimate goal is to remove password authentication for package upload entirely and go with well-scoped API keys instead.

[brainwane]

@vidartf per #994 (comment) , although we do not plan to enable 2FA for package upload, we do plan to use API keys to better secure package upload (such as via twine).