search

NHAS / wag

Simple Wireguard 2FA
BSD 3-Clause "New" or "Revised" License
502 stars 27 forks source link

Invalidate 2fa token after first use #11

Closed NHAS closed 1 year ago

NHAS commented 1 year ago

Currently a 2fa TOTP code can be used as many times as a user wants within the 30 second window it is valid.

This may allow a malicious actor who can somehow capture one valid 2fa code to reauthenticate during this time.

So we need to invalidate the token once it is used once.

NHAS commented 1 year ago

Potentially fixed on unstable