Authentication Security

140 vues Markdown

This tab adds extra identity checks after a password: two-factor codes, location checks, IP checks, country rules, JetPass and passkeys. It applies to clients and staff.

Opening the Screen

In the left menu, click Settings, then Security. Click Authentication in the tab row.

Address: {admin}/settings/security?general=authentication

What Is on the Screen

Two-Factor Authentication
A card for each verification method, each with its own switch.
Location Verification
Separate blocks for clients and staff.
IP Verification
Proxy and VPN detection.
Country Rules
Access restriction and proxy block scope.
JetPass
A passwordless sign-in option, switched on separately for clients and for staff.
Passkeys
Biometric passwordless sign-in with a fingerprint, face or device PIN.

Fields

Two-Factor Authentication

Verification Methods
An authenticator app (TOTP), an email code and an SMS code, plus any Authentication module you install. Email and SMS need an active module; without one the card shows disabled.
Force Enable for Clients
Off by default. Needs at least one method switched on above; forces clients to activate one at their next sign-in.
Force Enable for Staff
Off by default. Needs at least one method switched on above; forces staff to activate one at their next sign-in. Full Administrator accounts are exempt.
Show Popup
On by default. Shows a reminder for two-factor authentication in the client dashboard.
Trusted Device Duration (Clients)
Default: 0. When a client ticks "trust this device" while verifying, the browser skips the code for this many days. 0 hides the checkbox and asks on every sign-in. 365 days at most.
Trusted Device Duration (Staff)
Default: 0. The same window for staff signing in to the admin area.
Bind Trust to IP Address
Off by default. When on, a trusted device is only recognized from the IP address it was trusted on. Mobile users changing networks get asked for a code more often.

Location Verification

Asks for extra verification when the visitor's city or country changed since their last sign-in.

Enable for Clients
Off by default. Turning it on reveals a verification method (SMS by default) and a sensitivity level (Country by default).
Enable for Admin/Staff
Off by default. The same choices, kept separate from the client settings above.

IP Verification

Checks whether the visitor is using a proxy, VPN or anonymizer service.

Enable for Clients
On by default. Turning it on reveals a whitelist for trusted IP addresses, IP ranges or provider ASNs.
Enable for Admin/Staff
Off by default. Has its own whitelist.

Country Rules

Each card has a mode and a country list. The visitor's country comes from their IP address, and at sign-up the country on the form is checked too.

Mode
Required. Each card names its own modes and starts unrestricted; the others scope the rule to, or away from, the countries you pick.
Countries
Appears once you pick a mode other than the first. Saving with an empty list is refused.
Access Restriction
Limits which countries can open an account, sign in and place an order. Staff logins are not affected.
Proxy Block Scope
Narrows which countries the proxy and VPN block applies to. The block itself is switched on under IP Verification.

JetPass

Lets someone sign in with a one-time code emailed to them instead of typing a password. It sits beside the password form on the login page. Clients and staff are switched on separately.

Enable for Clients
Off by default. Shows the JetPass option on the client login page.
Enable for Staff
Off by default. Shows the JetPass option on the staff login screen. An emailed code is one factor, so two-factor verification still runs after it.
Code lifetime
Required. Default: 15 minutes. Accepts 1 to 60 minutes.
Failed attempt limit
Required. Default: 5 tries. Accepts 1 to 20 tries.

Passkeys

Lets someone sign in with a fingerprint, face scan or device PIN instead of a password. A passkey works only on your domain and cannot be phished. Clients and staff are switched on separately.

Enable for Clients
Off by default. Adds a passkey option to the client login page and a Passkeys section to their account security settings. A client with no passkey gets a one-time offer on the dashboard after signing in.
Enable for Staff
Off by default. Adds a passkey option to the staff login screen and a Passkeys section to Account Settings. A passkey already carries two factors, so no further code is asked after it.

Tasks

Requiring Two-Factor Authentication for Clients

  1. Open Two-Factor Authentication and switch on at least one method card, for example the authenticator app.
  2. Turn on Force Enable for Clients.
  3. Click Save Changes.

Restricting Access to Certain Countries

  1. Open Country Rules and set the Access Restriction mode to Allow Only the Selected Countries.
  2. Pick the countries you serve in the Countries list that appears.
  3. Click Save Changes.

Visitors from other countries can no longer open an account, sign in or place an order.

Signing In as Staff Without a Password

  1. Open Passkeys, turn on Enable for Staff and click Save Changes.
  2. Open your own Account Settings from the profile menu, go to the Security tab and expand Passkeys.
  3. Click Add Passkey and finish the prompt your device shows.

The key is listed with the date it was added. From the next visit the staff login screen offers Sign In with a Passkey; it opens the panel without a password and without a code.

Things to Watch

Access Restriction also blocks existing clients

The rule is checked at every sign-in, not only at sign-up. A client travelling outside your list cannot sign in or pay an invoice until they are back. Staff logins are exempt.

Each sub-tab saves on its own

Every sub-tab has its own Save Changes button. Switching to another sub-tab without saving loses your changes there.

IP Verification is not an address allowlist

It looks for proxy and VPN usage. To restrict the admin panel to specific IP addresses, use Admin Area IP Restriction on the Settings tab instead.

Device trust clears itself

A password reset, switching two-factor authentication on or off, or the client ending all sessions deletes that account's trusted devices. Clients can also remove single devices from the Trusted Devices list on the Security tab of their account settings.

JetPass needs a mail module

JetPass delivers its code by email only. Without an active mail module the option still appears, but no code arrives.

Passkeys need an HTTPS address

Browsers refuse to create or use a passkey on a non-secure address. If your installation address does not start with https, the tab warns you and the feature cannot be used.

Required Privileges

Viewing and saving any sub-tab on this screen needs the SECURITY_SETTINGS privilege.

Cet article vous a-t-il été utile ?

Merci pour votre retour !

Besoin d'aide supplémentaire ?

Notre équipe d'assistance est disponible 24h/24 pour tout ce que vous ne trouvez pas ci-dessus.

Nous contacter Ouvrir un ticket

Nous utilisons des cookies pour vous garder connecté, mémoriser votre langue et votre devise, et améliorer le site. Politique relative aux cookies