API request to /session/ endpoint fails and triggers 2FA verification e-mail

[mheland]

Issue Summary

2FA for Ghost admin - great, thank you!

However, requesting a session cookie over API to https://example.com/ghost/api/admin/session/

with json payload

{
    "username": "[email protected]",
    "password": "12345abc"
}

Gives API Error

{"errors":[{"message":"User must verify session to login.","context":null,"type":"Needs2FAError","details":null,"property":null,"help":null,"code":"2FA_TOKEN_REQUIRED","id":"03085e80-d45a-11ef-bd16-ad338f303067","ghostErrorCode":null}]}

The Ghost API requests sends a Verification code to my e-mail, [email protected] - which is not super helpful.

Tried logging in to Ghost with this user ([email protected]) and password - did not get a 2FA request.

Steps to Reproduce

1. Request a session from /admin/session/ endpoint with username and password as payload.
2. API error: "User must verify session to login" as above

Expected:
I log in on Ghost with Username and Password, is prompted for a 2FA code which I receive in mail.
After authenticating my user with the 2FA code to Ghost the API call now returns a Ghost session cookie from /admin/session/

Ghost Version

5.106.1-0-ga963b514+moya

Node.js Version

N/A

How did you install Ghost?

GhostPro Hosting

Database type

MySQL 5.7

Browser & OS version

N/A

Relevant log / error output

curl -c ghost-cookie.txt -d [email protected] -d password=abc123 -H "Origin: https://example.ghost.io" -H "Accept-Version: v3.0" https://example.ghost.io/ghost/api/admin/session/

{"errors":[{"message":"User must verify session to login.","context":null,"type":"Needs2FAError","details":null,"property":null,"help":null,"code":"2FA_TOKEN_REQUIRED","id":"6fba3a10-d45c-11ef-bd16-ad338f303067","ghostErrorCode":null}]}%

Code of Conduct

• I agree to be friendly and polite to people in this repository

[github-actions]

Hi there! If you're having any issue with a Ghost(Pro) site, please drop us an email on [email protected] and we'll be more than happy to give you a hand directly 🙂