Cloudflare tunnel: can I secure login to hosted app without having to
use 2FA every time??
reddit / selfhosted

----------------------------------------------------------------------
Ystebad · 2023-12-31 18:48

I have a cloud flare tunnel setup for external access to a locally
hosted app, which also has user verification.

But I want to lock down access externally and not rely on local app
security.

Currently I have an approved list of users/email addresses, and the
tunnel asks for email. but each and every time the system requires the
2FA code to be entered.

I assumed there would be some sort of cookie or way of verifying via
2FA (email confirmation) once and then not again, but cannot figure it
out.

Is there another way to have a limited number of approved users have
access without having to open and verify email code every use?

​

thank you!

​

----------------------------------------------------------------------
nathan12581 · 2023-12-31 19:24

Yeah using an application for the tunnel. For example I use google
oauth for some of my services. Only select google accounts can access
my service and it’ll only ask on a new browser session or new device
etc.

----------------------------------------------------------------------
ImplementNo7145 · 2023-12-31 19:27

You can try increasing the policy session duration to the max of 1
month in CF Access.

----------------------------------------------------------------------
Ystebad · 2023-12-31 19:48

users I've given access to do not use google for email if that's
required.  Is possible to use Authy or other 2FA with cookie storage?

----------------------------------------------------------------------
Ystebad · 2023-12-31 19:54

I thought I did  that before - looks like I didn't save.  So I just
changed that.  Wish there was longer than a month option but at least
that's something.  thank you.

Frustrating I can't make that longer than 1 month.  Seems an arbitrary
number to set as an upper time boundary.

----------------------------------------------------------------------
nitsky416 · 2023-12-31 20:06

Time isn't real

----------------------------------------------------------------------
AnApexBread · 2023-12-31 22:43

Set the session duration to longer.

----------------------------------------------------------------------
Ystebad · 2023-12-31 23:20

I thought I had done this but someone else suggested and I checked - I
don’t think it was. I set it to 1 month which seems to be the longest
possible.  Really would like it to be longer / indefinite but it’s a
step in the right direction thanks.