Closed desarrolla2 closed 1 year ago
Spaces are already handled in the 2fa providers:
https://github.com/scheb/2fa/blob/6.x/src/totp/Security/TwoFactor/Provider/Totp/TotpAuthenticator.php#L25-L28 https://github.com/scheb/2fa/blob/6.x/src/google-authenticator/Security/TwoFactor/Provider/Google/GoogleAuthenticator.php#L25-L28 https://github.com/scheb/2fa/blob/6.x/src/email/Security/TwoFactor/Provider/Email/EmailTwoFactorProvider.php#L48-L51
Reason why this is handled in the 2fa providers, because there might by a 2fa provider, which wants to have spaces (for whatever reason). So its not safe to assume that should always be stripped/trimmed from the code. And therefore because this behavior was made specific to the 2fa providers
Description
I sent auth code by email.
When the user receives his auth code, he can copy/paste some spaces ahead or behind. Then when he tries to authenticate, validation fails.
I think this will be dodged by trimming the auth code as follow: