Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Prevent the reuse of OTP #1578

Closed
sitaram-kalluri opened this issue Sep 25, 2023 · 3 comments
Closed

Prevent the reuse of OTP #1578

sitaram-kalluri opened this issue Sep 25, 2023 · 3 comments
Assignees
@srieteja
Labels
enhancement New feature or request

Comments

@sitaram-kalluri
Copy link
Member

sitaram-kalluri commented Sep 25, 2023 •
edited
Loading

Is your feature request related to a problem? Please describe.

When generating an OTP through the "get:otp" method for the purpose of approving or denying an enrollment, prevent the reuse of the same OTP for a different enrollment request, even if the OTP is still valid.
@sitaram-kalluri sitaram-kalluri added the enhancement New feature or request label Sep 25, 2023
@sitaram-kalluri sitaram-kalluri changed the title Prevent the re-use of OTP Prevent the reuse of OTP Sep 25, 2023
@cpswan
Copy link
Member

cpswan commented Sep 25, 2023

This is a pattern I had to implement for the Storj token service.

When I generate a nonce (similar to an OTP) a timestamp is stored alongside it. When it comes to validation the timestamp is checked to ensure that it hasn't expired. In the case of the token service that's just 60s, but for other use cases we just need a bigger number.

@murali-shris murali-shris removed their assignment Oct 16, 2023
@srieteja
Copy link
Contributor

This change has been made as part of #1609

@srieteja
Copy link
Contributor

Closing this ticket as completed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@srieteja srieteja

Labels
enhancement New feature or request
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@cpswan @sitaram-kalluri @murali-shris @srieteja