search

pyauth / pyotp

Python One-Time Password Library
https://pyauth.github.io/pyotp/
Other
2.97k stars 323 forks source link

Cannot decode URI due case-sensitivity #133

Closed LeightonSmallshire closed 8 months ago

LeightonSmallshire commented 2 years ago

When trying to parse a uri provided by runescape, the 'algorithm' parameter causes this error;

File "/usr/local/lib/python3.8/dist-packages/pyotp/init.py", line 78, in parse_uri ValueError: Invalid value for algorithm, must be SHA1, SHA256 or SHA512

stepping through the code shows this is a capitalization issue and should be easily fixed.

Example URI: 'otpauth://totp/playerName?secret=yourB64SecretHere&issuer=RuneScape&algorithm=sha1&digits=6&period=30'

kislyuk commented 2 years ago

Hello, thanks for your interest in PyOTP.

The otpauth URI specification requires the algorithm value to be capitalized. Thus this appears to be an issue in the runescape implementation. I am not inclined to change our treatment of these parameters without overwhelming evidence that other OTP implementations relax the spec in this way and do the case-insensitive matching described here.