Why key can validate multiple use ?

PHPGangsta / GoogleAuthenticator

PHP class to generate and verify Google Authenticator 2-factor authentication

http://phpgangsta.de/4376

BSD 2-Clause "Simplified" License

2.26k stars 698 forks source link

Closed parnus01 closed 8 years ago

parnus01 commented 8 years ago

when i validate key and success login , after i logout why it can use same key to validate

How can i implement it to expire key now after validate success.

thnak you

RobThree commented 8 years ago

PHPGangsta commented 8 years ago

The explanation of @RobThree is super good.

You have to take care of that yourself. That's why there is a text in my README that says:

For a secure installation you have to make sure that used codes cannot be reused (replay-attack).