"
Hello,
I have OpenVPN configured with TOTP-based two-factor authentication (2FA) and allow users to manage their own OTP seeds through the OPNsense web interface.
After updating OPNsense to 26.7.8_2, I noticed that users can no longer display the QR code when requesting a new OTP seed. Instead, the QR code area displays a broken image placeholder.
I'm not sure which version introduced this issue, as I regularly update my OPNsense installation on a weekly basis. I only noticed it today when some of my teammates switched to new mobile phones and attempted to use the "Request new OTP seed" function to configure their authenticator applications.
Current configuration
- OpenVPN users are members of the `OpenVPN` group.
- The following privileges are granted to this group under System → Access → Privileges:
- `page-openvpn-client-export`
- `page-system-usermanager-passwordmg`
These privileges are intended to allow users to export their own OpenVPN client configurations and manage their OTP seeds without requiring administrator intervention.
Additional observation
After revisiting the official [OPNsense Two-Factor Authentication Guide](https://docs.opnsense.org/manual/how-tos/two_factor.html#step-4-activate-authenticator-for-this-otp-seed), I found that an administrator (root) can still display the QR code through:
`ui/auth/user` → Edit user (pencil icon) → OTP seed → Show
However, this appears to require administrator access. Does this mean regular users can no longer display their own OTP QR codes, and must rely on an administrator whenever they need to register a new authenticator device?
Browser developer console error
I also checked the browser's F12 Developer Console and found the following Content Security Policy (CSP) error:
```
system_usermanager_passwordmg.php:1 Loading the image
'data:image/gif;base64,<redacted>' violates the following
Content Security Policy directive: "default-src 'self'".
Note that 'img-src' was not explicitly set, so 'default-src'
is used as a fallback. The action has been blocked.
```
Based on this error, could this be related to a CSP restriction preventing the browser from loading the QR code image embedded as a Base64 data URI?
Questions
1. Is this a known issue in OPNsense 26.7.8_2, or is this an intentional security policy change?
2. Should the `page-system-usermanager-passwordmg` privilege still allow regular users to generate and display their own OTP QR codes?
3. If this is a CSP-related regression, could the relevant `img-src` policy be adjusted to allow the required data URI without weakening the overall security policy?
I would appreciate any clarification or suggestions. Ideally, users should be able to manage their own OTP enrollment independently without requiring administrator intervention.
Security context: I understand that allowing users to request a new OTP seed themselves may raise security concerns, particularly in environments where the management interface is publicly accessible. However, my OPNsense deployment is within a closed network, and OpenVPN is used exclusively for internal access to a small number of isolated servers. The intention is simply to provide a convenient self-service OTP enrollment process for authorized internal users without requiring administrator intervention each time they change devices.
That said, I fully understand and respect it if restricting this functionality is an intentional security decision by the OPNsense developers. I am not requesting that the security policy be relaxed; I would just appreciate clarification on whether this behaviour is intentional or an unintended regression. If it is an intentional change, I am perfectly fine with that and will adjust our internal procedures accordingly.
Thank you.
I have OpenVPN configured with TOTP-based two-factor authentication (2FA) and allow users to manage their own OTP seeds through the OPNsense web interface.
After updating OPNsense to 26.7.8_2, I noticed that users can no longer display the QR code when requesting a new OTP seed. Instead, the QR code area displays a broken image placeholder.
I'm not sure which version introduced this issue, as I regularly update my OPNsense installation on a weekly basis. I only noticed it today when some of my teammates switched to new mobile phones and attempted to use the "Request new OTP seed" function to configure their authenticator applications.
Current configuration
- OpenVPN users are members of the `OpenVPN` group.
- The following privileges are granted to this group under System → Access → Privileges:
- `page-openvpn-client-export`
- `page-system-usermanager-passwordmg`
These privileges are intended to allow users to export their own OpenVPN client configurations and manage their OTP seeds without requiring administrator intervention.
Additional observation
After revisiting the official [OPNsense Two-Factor Authentication Guide](https://docs.opnsense.org/manual/how-tos/two_factor.html#step-4-activate-authenticator-for-this-otp-seed), I found that an administrator (root) can still display the QR code through:
`ui/auth/user` → Edit user (pencil icon) → OTP seed → Show
However, this appears to require administrator access. Does this mean regular users can no longer display their own OTP QR codes, and must rely on an administrator whenever they need to register a new authenticator device?
Browser developer console error
I also checked the browser's F12 Developer Console and found the following Content Security Policy (CSP) error:
```
system_usermanager_passwordmg.php:1 Loading the image
'data:image/gif;base64,<redacted>' violates the following
Content Security Policy directive: "default-src 'self'".
Note that 'img-src' was not explicitly set, so 'default-src'
is used as a fallback. The action has been blocked.
```
Based on this error, could this be related to a CSP restriction preventing the browser from loading the QR code image embedded as a Base64 data URI?
Questions
1. Is this a known issue in OPNsense 26.7.8_2, or is this an intentional security policy change?
2. Should the `page-system-usermanager-passwordmg` privilege still allow regular users to generate and display their own OTP QR codes?
3. If this is a CSP-related regression, could the relevant `img-src` policy be adjusted to allow the required data URI without weakening the overall security policy?
I would appreciate any clarification or suggestions. Ideally, users should be able to manage their own OTP enrollment independently without requiring administrator intervention.
Security context: I understand that allowing users to request a new OTP seed themselves may raise security concerns, particularly in environments where the management interface is publicly accessible. However, my OPNsense deployment is within a closed network, and OpenVPN is used exclusively for internal access to a small number of isolated servers. The intention is simply to provide a convenient self-service OTP enrollment process for authorized internal users without requiring administrator intervention each time they change devices.
That said, I fully understand and respect it if restricting this functionality is an intentional security decision by the OPNsense developers. I am not requesting that the security policy be relaxed; I would just appreciate clarification on whether this behaviour is intentional or an unintended regression. If it is an intentional change, I am perfectly fine with that and will adjust our internal procedures accordingly.
Thank you.
