scheb / 2fa

Two-factor authentication for Symfony applications 🔐
MIT License
505 stars 75 forks source link

Avoid fail code validation by spaces #182

Closed desarrolla2 closed 1 year ago

desarrolla2 commented 1 year ago

Description

I sent auth code by email.

When the user receives his auth code, he can copy/paste some spaces ahead or behind. Then when he tries to authenticate, validation fails.

I think this will be dodged by trimming the auth code as follow:


namespace Scheb\TwoFactorBundle\Security\TwoFactor;
// ..

class TwoFactorFirewallConfig
{
    // ..

    public function getAuthCodeFromRequest(Request $request): string
    {
        // return (string) ($this->requestDataReader->getRequestValue($request, $this->getAuthCodeParameterName()) ?? '');
        return trim($this->requestDataReader->getRequestValue($request, $this->getAuthCodeParameterName()) ?? '');
    }```
scheb commented 1 year ago

Spaces are already handled in the 2fa providers:

https://github.com/scheb/2fa/blob/6.x/src/totp/Security/TwoFactor/Provider/Totp/TotpAuthenticator.php#L25-L28 https://github.com/scheb/2fa/blob/6.x/src/google-authenticator/Security/TwoFactor/Provider/Google/GoogleAuthenticator.php#L25-L28 https://github.com/scheb/2fa/blob/6.x/src/email/Security/TwoFactor/Provider/Email/EmailTwoFactorProvider.php#L48-L51

Reason why this is handled in the 2fa providers, because there might by a 2fa provider, which wants to have spaces (for whatever reason). So its not safe to assume that should always be stripped/trimmed from the code. And therefore because this behavior was made specific to the 2fa providers