4 ms·

Really? A single if statement is all it would take? More hyperbole from you... (How do you log used codes, check if a code was previously used, and clean up ol

Really? A single if statement is all it would take? More hyperbole from you... (How do you log used codes, check if a code was previously used, and clean up old used codes in a single if statement?)

trillic 5y ago
Not OP, but yes really. Check the last login/session/whatever for that account and if it was within the period of the TOTP that was submitted, force a relog.
shaicoleman 5y ago
It already recorded in the database when the TOTP was last used, but it allowed to reuse the same code during the grace period (30 seconds later).
- diarrhea 5y ago
  Allowing authentication not only within the original time frame but one interval before and after is by design: https://en.wikipedia.org/wiki/Time-based_one-time_password#Security https://en.wikipedia.org/wiki/Time-based_one-time_password#S... .
  - prplr 5y ago
    The security issue is with allowing reuse, and not because of allowing use in the previous and next time frames.