added filter to control whether authcode autosubmits by eric-michel · Pull Request #741 · WordPress/two-factor

eric-michel · 2025-12-18T21:14:10Z

What?

Adds a filter to allow a theme or plugin to turn off auto submission of authcodes

Why?

Plugins that enhance two-factor may want to turn off auto-submission to allow the user time to interact with other form elements on the page prior to submission. See #723.

How?

A filter is added and assigned to a variable. That variable is checked prior to the relevant JS being output (and prevents it from printing entirely if the value is false).

Testing Instructions

Install the branch and activate plugin
Verify normal auto-submission experience
In theme's functions.php, add the following:

add_filter( 'two_factor_auto_submit_authcode', '__return_false' );

Observe that the authcode form no longer auto-submits.

Changelog Entry

Added - Themes and plugins can now disable auto-submission of authcodes via the two_factor_auto_submit_authcode filter

kasparsd

This looks good! Had one optional suggestion for moving the PHP state into JS variable to help move these scripts into standalone JS eventually.

Could you please document the filter, add the docblock comment (similar to other filters)?

kasparsd · 2025-12-22T10:20:47Z

class-two-factor-core.php

-								if ( undefined !== form.requestSubmit ) {
-									form.requestSubmit();
-									form.submit.disabled = "disabled";
+							<?php if ( $auto_submit_authcode ) { ?>


Could we use the variable state to generate a JS variable instead? That would allow us to eventually move this JS into an external file and pass that as data to the script.

Something like const autoSubmitEnabled = <?php echo json_encode( ... ); ?> and then use that here in pure JS if-check?

Happy to make this change! How/where would you like the JS variable to be output? I could output it as a data attribute on the form element (something like data-auto-submit) or could output it as a small <script> snippet in the <head> tag so it's a global variable that can be accessed. I kind of lean toward the data attribute to keep it scoped to the form itself.

@kasparsd any thoughts on the question above on approach?

@kasparsd @jeffpaul I opted to add a data attribute on the form and check for that in the JS if statement. Seems pretty clean to me. Take a look and let me know what you think!

…ithin JS

georgestephanis · 2026-02-12T13:56:16Z

class-two-factor-core.php

 		$interim_login       = isset( $_REQUEST['interim-login'] ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended

 		$rememberme = intval( self::rememberme() );
+		$auto_submit_authcode = apply_filters( 'two_factor_auto_submit_authcode', true );


It feels like this filter should also pass in the provider's key, to enable filtering based on some providers autosubmitting and others not.

Could probably also use phpdoc for the filter? I'm not sure how consistent we've been on it elsewhere -- https://developer.wordpress.org/coding-standards/inline-documentation-standards/php/#4-hooks-actions-and-filters

Suggested change

$auto_submit_authcode = apply_filters( 'two_factor_auto_submit_authcode', true );

$auto_submit_authcode = apply_filters( 'two_factor_auto_submit_authcode', true, $provider_key );

georgestephanis · 2026-02-12T14:04:53Z

class-two-factor-core.php

 		?>

-		<form name="validate_2fa_form" id="loginform" action="<?php echo esc_url( self::login_url( array( 'action' => $action ), 'login_post' ) ); ?>" method="post" autocomplete="off">
+		<form name="validate_2fa_form" id="loginform" action="<?php echo esc_url( self::login_url( array( 'action' => $action ), 'login_post' ) ); ?>" method="post" autocomplete="off"<?php if ( $auto_submit_authcode ) { ?> data-auto-submit="true"<?php } ?>>


I appreciate this running through a data attribute -- though as I'm looking at a bit of code from TOTP that adds a data-digits parameter in the provider's authentication_page()

two-factor/providers/class-two-factor-totp.php

Line 768 in 69706ea

<input type="text" inputmode="numeric" autocomplete="one-time-code" name="authcode" id="authcode" class="input authcode" value="" size="20" pattern="[0-9 ]*" placeholder="123 456" autocomplete="one-time-code" data-digits="<?php echo esc_attr( self::DEFAULT_DIGIT_COUNT ); ?>" />

that's what populates the expectedLength variable -- I'm wondering if instead it would be better to filter the data-digits property on the element? Maybe not include the attribute or something if it's filtered to null instead?

Also, kind of out-of-scope for this, but I'd like to see the autosubmit also work for codes that are alphanumeric or the like, so if it could maybe be elevated out of the "only numbers" conditional, but that's minor quibbles.

masteradhoc · 2026-02-22T09:52:41Z

Hey @eric-michel,

Could you take a moment to review the comments from @georgestephanis?
Your feedback would help us move forward and get this PR merged soon.

Thanks again for your contributions!

github-actions · 2026-02-22T09:52:52Z

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: eric-michel <ytfeldrawkcab@git.wordpress.org>
Co-authored-by: masteradhoc <masteradhoc@git.wordpress.org>
Co-authored-by: kasparsd <kasparsd@git.wordpress.org>
Co-authored-by: jeffpaul <jeffpaul@git.wordpress.org>
Co-authored-by: georgestephanis <georgestephanis@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

masteradhoc · 2026-02-25T20:26:24Z

class-two-factor-core.php

@@ -958,6 +958,7 @@ public static function login_html( $user, $login_nonce, $redirect_to, $error_msg
 		$interim_login       = isset( $_REQUEST['interim-login'] ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended

 		$rememberme = intval( self::rememberme() );


Suggested change

$rememberme = intval( self::rememberme() );

$rememberme = intval( self::rememberme() );

/**

* Filters whether the authentication code field should auto‑submit when the last digit is entered.

*

* This allows providers or site owners to disable (or enable) auto‑submission behavior

* of the TOTP/verification code input, e.g., for accessibility, UX, or device‑specific reasons.

*

* @since 0.16.0

*

* @param bool $auto_submit Whether to auto‑submit the auth code. Default true.

* @param string $provider_key The current two‑factor provider key.

* @return bool Filtered value of $auto_submit.

*/

add filter documentation as per request of @georgestephanis

added filter to control whether authcode autosubmits

808cd6a

eric-michel mentioned this pull request Dec 18, 2025

Add hook to turn off auto-submission of 2FA form #723

Open

jeffpaul added this to the 0.15.0 milestone Dec 18, 2025

jeffpaul linked an issue Dec 18, 2025 that may be closed by this pull request

Add hook to turn off auto-submission of 2FA form #723

Open

jeffpaul requested a review from kasparsd December 18, 2025 23:31

jeffpaul assigned eric-michel Dec 18, 2025

kasparsd approved these changes Dec 22, 2025

View reviewed changes

eric-michel added 2 commits December 23, 2025 12:43

updated readme

00605f2

swapped variable output to data attribute on form and check happens w…

bd499ec

…ithin JS

eric-michel requested a review from jeffpaul February 3, 2026 20:34

georgestephanis requested changes Feb 12, 2026

View reviewed changes

masteradhoc modified the milestones: 0.15.0, 0.16.0 Feb 18, 2026

masteradhoc reviewed Feb 25, 2026

View reviewed changes

Merge branch 'master' into auto-submit-hook

5acf913

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

added filter to control whether authcode autosubmits#741

added filter to control whether authcode autosubmits#741
eric-michel wants to merge 4 commits intoWordPress:masterfrom
eric-michel:auto-submit-hook

eric-michel commented Dec 18, 2025

Uh oh!

kasparsd left a comment

Uh oh!

kasparsd Dec 22, 2025

Uh oh!

eric-michel Dec 23, 2025

Uh oh!

jeffpaul Jan 6, 2026

Uh oh!

eric-michel Jan 9, 2026

Uh oh!

georgestephanis Feb 12, 2026

Uh oh!

georgestephanis Feb 12, 2026

Uh oh!

masteradhoc commented Feb 22, 2026

Uh oh!

github-actions bot commented Feb 22, 2026 •

edited

Loading

Uh oh!

masteradhoc Feb 25, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

	$auto_submit_authcode = apply_filters( 'two_factor_auto_submit_authcode', true );
	$auto_submit_authcode = apply_filters( 'two_factor_auto_submit_authcode', true, $provider_key );

		@@ -958,6 +958,7 @@ public static function login_html( $user, $login_nonce, $redirect_to, $error_msg
		$interim_login = isset( $_REQUEST['interim-login'] ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended

		$rememberme = intval( self::rememberme() );

-		$rememberme = intval( self::rememberme() );
+		$rememberme = intval( self::rememberme() );
+        /**
+         * Filters whether the authentication code field should auto‑submit when the last digit is entered.
+         *
+         * This allows providers or site owners to disable (or enable) auto‑submission behavior
+         * of the TOTP/verification code input, e.g., for accessibility, UX, or device‑specific reasons.
+         *
+         * @since 0.16.0
+         *
+         * @param bool   $auto_submit  Whether to auto‑submit the auth code. Default true.
+         * @param string $provider_key The current two‑factor provider key.
+         * @return bool  Filtered value of $auto_submit.
+         */

Conversation

eric-michel commented Dec 18, 2025

What?

Why?

How?

Testing Instructions

Changelog Entry

Uh oh!

kasparsd left a comment

Choose a reason for hiding this comment

Uh oh!

kasparsd Dec 22, 2025

Choose a reason for hiding this comment

Uh oh!

eric-michel Dec 23, 2025

Choose a reason for hiding this comment

Uh oh!

jeffpaul Jan 6, 2026

Choose a reason for hiding this comment

Uh oh!

eric-michel Jan 9, 2026

Choose a reason for hiding this comment

Uh oh!

georgestephanis Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

georgestephanis Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

masteradhoc commented Feb 22, 2026

Uh oh!

github-actions bot commented Feb 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

masteradhoc Feb 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

github-actions bot commented Feb 22, 2026 •

edited

Loading

masteradhoc Feb 25, 2026 •

edited

Loading