[Bug] Missing issuer in QR causes duplicates tokens

[falghamdi125]

Hello everyone,

This is an issue related to OTPs scanned with URI. If the QR-encoded URI lacks the issuer string in the label, a pop-up message appears, suggesting that you add the issuer. It also gives you the option to proceed with adding the OTP without the issuer. However, this results in duplicate tokens.

Technically, OTP URI contains an important parameter which is the label. Labels usually contain issuer and account strings e.g. google:user@gmail.com where google is the issuer and after delimiter : comes the account. Some systems don't provide issuer string in label parameter. Also, the optional parameter &issuer=foo could be missing too resulting into this issue .

Example strings from such systems:

otpauth://hotp/test%40github?secret=aaaaaaaaaaaaaaaaaaaaaaaaaa&algorithm=SHA1&digits=6&period=30&counter=0
otpauth://totp/test%40github?secret=aaaaaaaaaaaaaaaaaaaaaaaaaa&algorithm=SHA1&digits=6&period=30

The above URI as QR code:

Steps to reproduce

1. Convert OTP URI or scan QR code above.
2. Click the above nav button next .
3. Click Use empty issuer.
4. You can see that two records have been created.

Enviroment:

• FreeOTP Release: 2.3.5
• iOS: 18.1

Best