umbraco-security-2fa

Adds two-factor authentication (2FA/MFA) with an authenticator app (TOTP, Google or Microsoft Authenticator) to an Umbraco 17+ site, for backoffice users, website members, or both. Use this whenever the user asks to add, enable or require 2FA, MFA, two-step verification or an authenticator app for Umbraco editors or members, or to fix 2FA that is missing from the backoffice user menu, a member login that loops back to the login form after 2FA was enabled, a member profile page that crashes listing 2FA providers, or a site that won't start with "An item with the same key has already been added" after adding 2FA. Also use it when the user wants editors or members to confirm sign-in with a code from their phone, or mentions TOTP or one-time codes, even if they never say "2FA". SKIP: Umbraco Cloud's Umbraco ID MFA, MFA enforced by an external identity provider (SSO), non-Umbraco projects and Umbraco versions below 17.

الانتقال إلى التثبيت مراجعة الملفات

المستودع: umbraco/Umbraco-CMS-Implementation-Skills
آخر نشاط في المصدر: ٢١ أكتوبر ٢٠٢٦ في ٠٨:٠٦
لغة SKILL.md المكتشفة: الإنجليزية
النجوم: ٧
التفرعات: ٨

خيارات التثبيت

يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.

التثبيت بمساعدة مساعد ذكي

انسخ هذا الطلب إلى المساعد الذكي الذي تستخدمه.

Follow https://skillsmp.com/skill-install/prompt.md to install only the Agent Skill at https://github.com/umbraco/Umbraco-CMS-Implementation-Skills/tree/main/plugins/implementation/skills/umbraco-security-2fa.

يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.

npx skills add https://github.com/umbraco/Umbraco-CMS-Implementation-Skills --skill umbraco-security-2fa

يبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.

تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.

مراجعة ملفات المصدر

اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.

مستكشف الملفات

37 ملفات

SKILL.md

تعليمات المصدر · معاينة للقراءة فقط

name: umbraco-security-2fa
description: Adds two-factor authentication (2FA/MFA) with an authenticator app (TOTP, Google or Microsoft Authenticator) to an Umbraco 17+ site, for backoffice users, website members, or both. Use this whenever the user asks to add, enable or require 2FA, MFA, two-step verification or an authenticator app for Umbraco editors or members, or to fix 2FA that is missing from the backoffice user menu, a member login that loops back to the login form after 2FA was enabled, a member profile page that crashes listing 2FA providers, or a site that won't start with "An item with the same key has already been added" after adding 2FA. Also use it when the user wants editors or members to confirm sign-in with a code from their phone, or mentions TOTP or one-time codes, even if they never say "2FA". SKIP: Umbraco Cloud's Umbraco ID MFA, MFA enforced by an external identity provider (SSO), non-Umbraco projects and Umbraco versions below 17.

# Two-factor authentication Umbraco has two separate identity systems, and each gets 2FA its own way. Both use an `ITwoFactorProvider` that you implement and register; what differs is the UI around it. | | **A: Backoffice users** | **B: Website members** | |---|---|---| | Reference | [users.md](references/users.md) | [members.md](references/members.md) | | Who signs in | Editors and admins at `/umbraco` | Visitors on the public site | | Registered on | `BackOfficeIdentityBuilder` | `MemberIdentityBuilder` | | UI you write | A JSON manifest; the backoffice supplies the screens | The login view's code step and a setup page | ### How to decide Settle which identity system the request is about before writing code: "editors", "admins", "backoffice" and "CMS login" mean A; "members", "customers", "my account" and "website login" mean B. If the user wants both, do both: they coexist. Open the reference for each one you build and start from its assets. The docs sample has mistakes that the references list and the assets fix. ## Version compatibility Targets **Umbraco 17+**, checked against the `Umbraco.Cms` 17.5.3 source. The assets use the third-party `GoogleAuthenticator` NuGet package, version 3.x (tested on 3.2.0). ## Best practices - **The provider name is permanent.** It is stored with every enrolment. If it changes, existing enrolments no longer match a provider and are ignored, so those accounts sign in with a password alone and nobody is told. - **One provider per identity system.** Users and members share a single provider list. Registering the same provider name on both builders fails at startup with a duplicate-key error. - **Tighten the code window.** `GoogleAuthenticator` accepts codes up to five minutes either side by default. The assets pass 30 seconds. - **The secret stays on the server.** The QR code is a `data:` URI generated in-process. Never build it with an online QR or chart service: the URL would carry the secret. A Content Security Policy on the setup page needs `img-src data:`. - **Plan recovery before go-live.** There are no recovery codes. Agree who can reset a locked-out account; each reference says how. - **Prove it with a sign-in.** It is done when an enrolled account is asked for a code and a wrong code is refused. A build that compiles proves neither. If the site can't be run, say which checks were not made. ## Validation Objective assertions live in [`evals/evals.json`](evals/evals.json); run them with `umbraco-skill-evaluator`. Both approaches are **Asserted** by the runtime gate: `examples/users/` (Clean host) signs a user in through the backoffice login API and its 2FA step; `examples/members/` (blank host) enrols a member through the setup page, then signs in with a code.

عرض على GitHub

العودة إلى البحث العودة إلى التثبيت

umbraco-design-fundamentals

The look of a server-rendered Umbraco 17 site: CSS/JS in wwwroot, rendering content (typed values, fallbacks, child pages) and media (images, crops, resizing, video) in Razor, and a guided path for a whole design. Use when asked to "add CSS/JS", "add Bootstrap/Tailwind", "show an image", "render a crop", "resize an image", "list child pages", "fall back to the parent's value", or by Umbraco newcomers: "create a design for my Umbraco site", "style my site", "use my HTML template/theme", "change the colours/fonts", "same header and footer on every page", "build a demo site". Generic phrases need Umbraco context (an Umbraco project, or Umbraco mentioned). SKIP: templates, layouts, partials or controllers on their own (use umbraco-templating); non-Umbraco projects; mockups with no Umbraco site (Figma, slides); Umbraco < 17; headless frontends; sitemaps (umbraco-sitemap); 404/500 pages (umbraco-custom-error-pages).

2026-10-21

umbraco-custom-error-pages

Implement custom 404 and 500 error pages in Umbraco 16.1+. Offers two 404 approaches: a multi-site-aware IContentLastChanceFinder (default) and the official docs' zero-code Error404Collection config; 500s use a shared MVC controller. Trigger: user asks to "add custom error pages", "set up 404 page", "handle 500 errors", "create page not found", "implement error handling", "customize error pages in Umbraco". SKIP: non-Umbraco projects, and maintenance/upgrade pages (use umbraco-custom-maintenance-page instead).

2026-10-21

umbraco-health-check

Create and localize custom Umbraco 17 Health Checks for backend C# and Razor frontend experiences, including multilingual Dictionary items and safe fallback handling. Use this skill when the user asks to add a custom Umbraco Health Check, validate an appsettings value, show health-check guidance in Razor, localize a check, organise its Dictionary items, or handle a missing translation safely. SKIP: non-Umbraco projects, Umbraco versions below 17, existing built-in checks that only need configuration, and liveness/readiness or orchestrator probe endpoints.

2026-10-21

عرض الكل من هذا المستودع

umbraco-security-2fa

معلومات المصدر

خيارات التثبيت

التثبيت بمساعدة مساعد ذكي

مراجعة ملفات المصدر

المزيد من هذا المستودع

التثبيت بمساعدة مساعد ذكي

المزيد من هذا المستودع