search

nextcloud / twofactor_totp

🔑 Second factor TOTP (RFC 6238) provider for Nextcloud
https://apps.nextcloud.com/apps/twofactor_totp
GNU Affero General Public License v3.0
284 stars 58 forks source link

First token after registration invalid #1484

Closed Th3l5D closed 5 months ago

Th3l5D commented 6 months ago

Steps to reproduce

  1. Create a new guest local account with TOTP forced
  2. Setup TOTP on external application
  3. Validate TOTP configuration on nextcloud with the token given by TOTP app
  4. Rapidly signin with the new account and with the same token as the previous step (with the token of course still valid)

Expected behaviour

token is validated and user connection is done

Actual behaviour

token is considered as incorrect and we need to wait for a new token in order to validate the connection

Server configuration

Operating system: Debian 12

Web server: Apache

Database: Mysql

PHP version: PHP8

Version: (see admin page) 27.1.5

Updated from an older version or fresh install: from 27.1.x branch

List of activated apps:

given in private if needed

The content of config/config.php:

Not really revelant, given in private if needed

Client configuration

Browser: Last Firefox/last Brave

Operating system: Windows 10

Logs

Web server error log

given in private if needed

Server log (data/nextcloud.log)

given in private if needed

Browser log

Not really revelant, given in private if needed

ChristophWurst commented 6 months ago

compare server and phone clocks. are they in sync?

Th3l5D commented 6 months ago

Hey @ChristophWurst, Thanks for the answer, but unfortunately, I don't think it's the issue:

Th3l5D commented 5 months ago

Hey again,

Do you know if this issue if validated? Do you need some extra info?

ChristophWurst commented 5 months ago

Rapidly signin with the new account and with the same token as the previous step (with the token of course still valid)

Overlooked this the other day. This is actually by design. The app has protection for replay attacks. A code can only be used once.

Ref https://github.com/nextcloud/twofactor_totp/pull/489

Th3l5D commented 5 months ago

OK, that explains everything, thanks for the information :)