From 05fa0e37be509ca836485ae1d6c3d1b208a68b8e Mon Sep 17 00:00:00 2001
From: tom27052006 <83423411+tom27052006@users.noreply.github.com>
Date: Thu, 30 Jul 2026 20:17:53 +0200
Subject: [PATCH] Limit 2FA remember duration to 90 days

---
 .env.template |  2 +-
 src/config.rs | 28 +++++++++++++++++++++++++---
 2 files changed, 26 insertions(+), 4 deletions(-)

diff --git a/.env.template b/.env.template
index a5e7f458..502939ca 100644
--- a/.env.template
+++ b/.env.template
@@ -602,7 +602,7 @@
 ## Note that the checkbox would still be present, but ignored.
 # DISABLE_2FA_REMEMBER=false
 ##
-## Number of days before a remembered 2FA login expires (min: 1, max: 365).
+## Number of days before a remembered 2FA login expires (min: 1, max: 90).
 # TWO_FACTOR_REMEMBER_DAYS=30
 ##
 ## Authenticator Settings
diff --git a/src/config.rs b/src/config.rs
index 8beec683..4e771374 100644
--- a/src/config.rs
+++ b/src/config.rs
@@ -711,7 +711,7 @@ make_config! {
         /// Disable Two-Factor remember |> Enabling this would force the users to use a second factor to login every time.
         /// Note that the checkbox would still be present, but ignored.
         disable_2fa_remember:   bool,   true,   def,    false;
-        /// Two-Factor remember duration |> Number of days before a remembered Two-Factor login expires (min: 1, max: 365).
+        /// Two-Factor remember duration |> Number of days before a remembered Two-Factor login expires (min: 1, max: 90).
         two_factor_remember_days: i64,  true,   def,    30;
 
         /// Disable authenticator time drifted codes to be valid |> Enabling this only allows the current TOTP code to be valid
@@ -1234,8 +1234,8 @@ fn validate_config(cfg: &ConfigItems, on_update: bool) -> Result<(), Error> {
         err!("`INVITATION_EXPIRATION_HOURS` has a minimum duration of 1 hour")
     }
 
-    if !(1..=365).contains(&cfg.two_factor_remember_days) {
-        err!("`TWO_FACTOR_REMEMBER_DAYS` must be between 1 and 365 days")
+    if !(1..=90).contains(&cfg.two_factor_remember_days) {
+        err!("`TWO_FACTOR_REMEMBER_DAYS` must be between 1 and 90 days")
     }
 
     // Validate schedule crontab format
@@ -1853,3 +1853,25 @@ handlebars::handlebars_helper!(webver: | web_vault_version: String |
 handlebars::handlebars_helper!(vwver: | vw_version: String |
     semver::VersionReq::parse(&vw_version).expect("Invalid Vaultwarden version compare string").matches(&VW_VERSION)
 );
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn config_with_two_factor_remember_days(days: i64) -> ConfigItems {
+        ConfigBuilder {
+            database_url: Some("sqlite://:memory:".to_owned()),
+            two_factor_remember_days: Some(days),
+            ..Default::default()
+        }
+        .build()
+    }
+
+    #[test]
+    fn two_factor_remember_days_are_limited_to_ninety() {
+        assert!(validate_config(&config_with_two_factor_remember_days(90), false).is_ok());
+
+        let error = validate_config(&config_with_two_factor_remember_days(91), false).unwrap_err();
+        assert_eq!(format!("{error:?}"), "`TWO_FACTOR_REMEMBER_DAYS` must be between 1 and 90 days");
+    }
+}