Allow session elevation to affect settings visibility

Description

Redesign the UI of the User Settings subsystem so that access to it can be secured behind 2FA.

Use Case

For users who wish that access to the User Settings can be secured behind 2FA, to prevent unintended information leaking to those not authorized to access these settings, but who may have compromised the username/password of an account.

Details

I have noticed after enabling 2FA using TOTP and passkeys that the "User Settings" subsystem in Authelia cannot currently be secured with 2FA.

Currently, the UI prompt that is displayed when 2FA is enabled after logging in to Authelia using a username/password will have a link to the user's Account Settings page in the top-right corner:

eg:

1. Prompt for first-factor authentication:

1. After successful authentication with username/password, the TOTP page includes the ability to access the user's Settings page prior to 2FA authentication:

1. Clicking on the link will allow navigation to the settings page (as will navigating to the /settings URL from the browser) without 2FA authentication taking place:

Note that attempting to set policy: 'two_factor' for the domain name of the authelia server has no effect to allow 2FA, as attempting to navigate to the /settings URL direct from the browser will permit access, as will clicking the Settings link described above on the TOTP page, even with the policy: 'two_factor' rule set in the configuration.yml file.

I do not believe this is a significant security issue which is why I have not filed this as a security vulnerability, as any significant actions taken on the User Settings page (such as password change, adding/removing TOTP or WebAuthn credendials) still require elevated session authentication via emailed one-time code. Thus, even if an attacker has compromised the username/password for an account, they are not able to alter the account to gain access.

However, it does allow for anyone who can obtain the one factor username/password to access the user settings, which may leak information to would-be attackers, or to alter the default 2FA method (if multiple are configured).

This feature request is for the following suggestion:

1. Remove the User Settings UI element from the TOTP page
2. Allow the User Settings backend to be protected with 2FA (perhaps a configurable option in the configuration.yml?)

Documentation

No response

Generative AI

No

Pre-Submission Checklist

• I agree to follow the Code of Conduct

• I have checked for related issues and checked the documentation