Merge branch 'sh-fix-otp-backup-invalidation-10-5' into 'security-10-5'

app/controllers/concerns/authenticates_with_two_factor.rb

@@ -56,6 +56,7 @@ module AuthenticatesWithTwoFactor
       session.delete(:otp_user_id)
 
       remember_me(user) if user_params[:remember_me] == '1'
+      user.save!
       sign_in(user)
     else
       user.increment_failed_attempts!

changelogs/unreleased/sh-fix-otp-backup-code-invalidation.yml

+---
+title: Ensure that OTP backup codes are always invalidated
+merge_request:
+author:
+type: security

spec/features/login_spec.rb

@@ -125,6 +125,18 @@ feature 'Login' do
             expect { enter_code(codes.sample) }
               .to change { user.reload.otp_backup_codes.size }.by(-1)
           end
+
+          it 'invalidates backup codes twice in a row' do
+            random_code = codes.delete(codes.sample)
+            expect { enter_code(random_code) }
+              .to change { user.reload.otp_backup_codes.size }.by(-1)
+
+            gitlab_sign_out
+            gitlab_sign_in(user)
+
+            expect { enter_code(codes.sample) }
+              .to change { user.reload.otp_backup_codes.size }.by(-1)
+          end
         end
 
         context 'with invalid code' do