3 ms·
Yeah, I think a pending state is probably more ideal here. But I could see that being a little bit of a lift. (I'm still not 100% clear on the security advanta
by woodruffw 4y ago
Yeah, I think a pending state is probably more ideal here. But I could see that being a little bit of a lift.
(I'm still not 100% clear on the security advantages of requiring MFA for API tokens that are limited in scope -- assuming that NPM's tokens don't serve as full user credentials, I don't think they should enforce MFA on them.)