BrandonPotter / GoogleAuthenticator

Simple, easy to use server-side two-factor authentication library for .NET that works with Google Authenticator and Authy.
Apache License 2.0
369 stars 126 forks source link

Timetolerance working as intended? #230

Closed MiiChielHD closed 1 month ago

MiiChielHD commented 1 month ago

The TimeTolerance, a timespan, behaves weird so far I test with version 3.2.0;

Using Timespan.FromSeconds(30) makes it usable to exactly 30 seconds. With Timespan.FromSeconds(31) i'm able to use a totp the whole time of next totp as well, so in the next 30 seconds, or 60 seconds in total.

What is the idea of timetolerance?

tfa.ValidateTwoFactorPIN(argSecretKey, argPIN, TimeSpan.FromSeconds(31));

flytzen commented 1 month ago

The spec for TOTP codes specify that the code should change every 30 seconds. Each 30 second period is an interval. Rather than asking you to specify the number of intervals you want to allow (to allow for time drift) we allow you to specify this in seconds. The value you specify will, therefore, always be rounded up to the next 30 seconds. Unless you a very familiar with the spec and time drift, you are strongly advised not to change the default.