3 ms·
In the past, when I've implemented TOTP on the server, I've allowed for a couple of time periods of drift. But I recorded the time period that last matched, and
by dunham 7y ago
In the past, when I've implemented TOTP on the server, I've allowed for a couple of time periods of drift. But I recorded the time period that last matched, and only allowed subsequent authentication attempts to be strictly greater than the last successful time period, to prevent replay attacks.
- susam 7y agoYes, RFC 6238 requires this too. Quoting from https://tools.ietf.org/html/rfc6238#section-5.2 https://tools.ietf.org/html/rfc6238#section-5.2: > Note that a prover may send the same OTP inside a given time-step window multiple times to a verifier. The verifier MUST NOT accept the second attempt of the OTP after the successful validation has been issued for the first OTP, which ensures one-time only use of an OTP.