Login Security: 2FA & Passkeys changelog
All notable changes to Login Security: 2FA & Passkeys (kv_login_security_2fa) are documented here.
The format follows Keep a Changelog and the project uses Semantic Versioning.
[Unreleased]
Section titled “[Unreleased]”[1.0.0] - 2026-10-20
Section titled “[1.0.0] - 2026-10-20”- Second sign-in step after the password for administrators, vendor administrators and customers, covering every sign-in path that ends in a CS-Cart account (password, e-mail one-time password, social sign-in, phone codes, password-recovery link).
- Policies per user type: required (forced setup right after the password), optional or off.
- Authenticator apps (TOTP, RFC 6238) with a QR code drawn on the server, encrypted secrets and replay protection.
- Passkeys (WebAuthn, ES256 and RS256) as a second step and as passwordless sign-in on the storefront and in the admin and vendor panel.
- 10 single-use recovery codes stored as keyed hashes.
- Trusted devices with a configurable lifetime; off for administrators unless allowed.
- Lock after wrong codes, security e-mails (lock, recovery code used, method added or removed, reset).
- Admin page Login security (overview per role, users, reset, unlock), security log, profile tab.
- Root administrator protection and a server-side emergency switch.
- License client and self-healing upgrades.