OXID Security Module V. 4.0

Release date: 26-08-2026

Features

  • Accounts with two-factor authentication (2FA) enabled can now also authenticate via OXAPI. Up to V. 3.x, 2FA and OXAPI were mutually exclusive.

    Login happens in two steps: for a 2FA account, the standard login first returns a challenge token, which the client exchanges for a regular access token after entering the one-time code sent by email. If the code did not arrive, the client can request a new one with the resendTwoFactorOtp mutation. For developer details, see Two-Factor Authentication via OXAPI.

  • Customers can now also enable or disable their own 2FA preference via OXAPI (setTwoFactorAuth mutation).

  • Enabling 2FA invalidates the account’s existing OXAPI tokens (access and refresh tokens). An already-issued session therefore cannot outlive the activation; the user must log in again and then complete the 2FA flow.

  • The 2FA code email is now customizable: subject and body are generated from a CMS content block (oesm2faotpemail) and can be edited per language in the admin backend to match your corporate design. If no CMS content is present, the shop sends a built-in default email. See Customizing the OTP email.

  • The OTP code lifetime and the API challenge lifetime are now configurable (default 300 seconds / 5 minutes each). The OTP code lifetime was previously hardcoded. See Enable Two-Factor Authentication shop-wide.

Fixes

Prerequisites

  • OXID eShop 7.5.x.

  • PHP 8.3 or higher (tested up to PHP 8.5).

Known limitations

  • Logins in the admin backend are not protected by 2FA. The protection applies to storefront logins (customer account) and to logins via OXAPI.