@bryan-robinson

We are not using DPoP at all, and the app/me call is being made transparently by the FusionAuth Vue SDK, so is not something we can change. That is the default when setting up the VueJS SDK.

I've isolated this to the upgrade to 1.60.0. It has the issue. 1.59.1 works fine.

I suspect it's due to the new tty claim that is included in the at and idt tokens, which did not exist before.

The external JWT reconcile API only returns at and rt tokens. It does not return an idt. So we were setting the at value for the idt cookie. But now that the two tokens can be differentiated, I suspect that this causes the issue.

Was trying to use the Hosted Backend app/refresh API to get refreshed tokens, including an idt, but that is returning a 403-Forbidden for some reason. Documentation on what is required for that API call is rather sparse Says it needs the app.rt cookie, which we have set...but seems it needs more.

@andrzej-taramina Usually, when we see 403s on the hosted backend, the root cause ends up being an origin issue.

The endpoint calls need to originate from the same domain the FusionAuth instance lives at

There's some CORS information in this section of the hosted backend docs: https://fusionauth.io/docs/apis/hosted-backend#prerequisites

Hey @sameer-syedmanzur!

If you're on any paid plan, I'd recommend looking at our Generic Messengers.

When the generic messenger is hit, it fires off a request to any HTTP endpoint you want. You can then use any method you need to to get the code to the user or post it back to the API to complete the 2nd factor.

If you're on the Community edition (free version), that's not accessible to you, though.

For solution on the community edition, check out this doc if you haven't read it yet: https://fusionauth.io/docs/lifecycle/authenticate-users/multi-factor-authentication#build-your-own-interface

That's how you set up a custom interface for TOTP. That would be the best-practice way of doing 2fa without smtp on community edition. I haven't done anything TOTP-based for testing, but I'd wager there's a TOTP application with an API that could handle this.

Depending on the use case, it might also make sense to set up something simple with something like MailTrap to do testing via SMTP instead of going through all this. That may be a problem depending on the use case, though