search

jaredhanson / passport-totp

TOTP authentication strategy for Passport and Node.js.
MIT License
150 stars 47 forks source link

How to restrict code lifetime to one minute? #6

Open green13 opened 8 years ago

green13 commented 8 years ago

Hello In two-factor example, code generated with Google Authenticator lifetime is 4 minutes. If set option passport.use(new TotpStrategy({window: 1}, ... lifetime will be two minutes. How to set the lifetime of one minute?

unknowndomain commented 7 years ago

The window parameter determines how many key periods are permitted, i.e. if you set it to 1, the code will allow the current code and the previous one. By default the window parameter is set to 4.

The other factor that effects this is the key period, normally this is 30 seconds, however you set this as part of calling the done:

return done( null, base32.decode( key ), 30 );