Bug Report / Feature Request — USG FLEX Web UI: 2FA verification field does not accept ENTER key

Options
Zyxel_USG_User
Zyxel_USG_User Posts: 116 image  Ally Member
First Answer First Comment Friend Collector First Anniversary

Summary

Inconsistent keyboard behaviour between the login stage and the 2FA verification stage creates a daily usability and security friction point for administrators using standalone mode with 2FA enabled.

Current behaviour

Step 1 — Username/password screen: ENTER key submits the form correctly.

image.png

Step 2 — 2FA verification screen: ENTER key does not submit. Mouse click on the Verify button is mandatory.

image.png

Why this matters operationally

TOTP codes are time-limited to 30 seconds. The forced context switch from keyboard to mouse on the 2FA screen costs 2-4 seconds minimum. When a code is in its final seconds, this delay is enough to cause the code to expire before submission, requiring the administrator to wait for the next code cycle and re-enter. Multiplied across several logins per day, across multiple devices, this is a significant and entirely unnecessary friction point.

Expected behaviour

ENTER key should submit the 2FA verification form, consistent with the behaviour of the preceding username/password screen.

Fix required

Add keydown ENTER event listener to the 2FA verification input field, identical to the implementation already present on the username/password screen. This is a one-line frontend fix.

Environment

Standalone firewall mode, web UI login, 2FA enabled, any browser.

Priority justification

Administrators managing security infrastructure should not be forced to use a mouse to complete a security-critical authentication step. The inconsistency is particularly punishing in time-sensitive TOTP scenarios.

All Replies

  • Zyxel_Melen
    Zyxel_Melen Posts: 4,713 image  Zyxel Employee
    Zyxel Certified Network Engineer Level 1 - Switch Zyxel Certified Network Administrator - Switch Zyxel Certified Network Administrator - Nebula Zyxel Certified Sales Associate
    edited April 15

    Hi @Zyxel_USG_User

    I did a quick replicate with my USG FLEX 100(5.42 patch 1) via Chrome, and the 2FA verify button is clickable.

    Jam | Video - https://10.214.36.53/

    Could you help to share:

    1. Your firewall's firmware version.
    2. Your browser.
    3. Use Jam.dev to record a video. (You may share the link via a private message) (P.S. If your browser doesn't support this plugin, you may skip it.)

    Thanks!

    Zyxel Melen


  • Zyxel_USG_User
    Zyxel_USG_User Posts: 116 image  Ally Member
    First Answer First Comment Friend Collector First Anniversary
    edited April 15
    1. V5.42(ABAR.1), latest for my 'since 2017' years old USG device. Same consistent behaviour since years.
    2. Any browser, Edge and Firefox unhardened/standard installs, other hardened browsers- it makes no difference, the behaviour is the same everywhere, since years and tens of browser versions, firewall firmware versions, different operating systems, standard browser installations inclusive. Using the same browser to log in here to the community: username + password, ENTER works, then 2FA, ENTER works. FIrewall, 1. enter username+password always works pressing ENTER, 2. entering 2FA code then pressing ENTER never works, I need to grab the mouse to press on the button.
    3. No recording available.
  • Zyxel_Melen
    Zyxel_Melen Posts: 4,713 image  Zyxel Employee
    Zyxel Certified Network Engineer Level 1 - Switch Zyxel Certified Network Administrator - Switch Zyxel Certified Network Administrator - Nebula Zyxel Certified Sales Associate

    Get the issue point. I'm checking with our team and will update you once I get further information.

    Zyxel Melen


  • Zyxel_USG_User
    Zyxel_USG_User Posts: 116 image  Ally Member
    First Answer First Comment Friend Collector First Anniversary

    Just adding informations- at the same time, I log into other different devices from other vendors using 2FA since all these years , and the whole 2FA process always worked and still does with other vendors.