search

speakeasyjs / speakeasy

**NOT MAINTAINED** Two-factor authentication for Node.js. One-time passcode generator (HOTP/TOTP) with support for Google Authenticator.
MIT License
2.7k stars 228 forks source link

urls generated by speakeasy.otpauthURL do not match the once generated by generateSecret #60

Closed id0Sch closed 7 years ago

id0Sch commented 7 years ago

the issue is that generateSecret runs the name property through encodeURIComponent and otpauthURL does not. would you like me to open a PR to either fix it or change the documentation to show this? thanks!

railsstudent commented 7 years ago

Yeah, I notice that too. Furthermore, counter passed to otpauthURL is not appended to query; therefore, the counter in server side does not match the counter in google authenticator app.

mikepb commented 7 years ago

Changing the behavior of generateSecret will break backwards compatibility. @markbao Should this bugfix bump Speakeasy to 3.0?

@railsstudent Omitting counter in the otpauthURL output is definitely a bug. Could you open a new issue for it? Pull request appreciated!

id0Sch commented 7 years ago

I honestly think otpauthURL should change, but it's the same breakage

On Wed, Dec 21, 2016 at 22:21 mikepb notifications@github.com wrote:

Changing the behavior of generateSecret will break backwards compatibility. @markbao https://github.com/markbao Should this bugfix bump Speakeasy to 3.0?

@railsstudent https://github.com/railsstudent Omitting counter in the otpauthURL output is definitely a bug. Could you open a new issue for it? Pull request appreciated!

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub https://github.com/speakeasyjs/speakeasy/issues/60#issuecomment-268628850, or mute the thread https://github.com/notifications/unsubscribe-auth/AFl9RAx-QQTGmCx6ZVLBt6vJeLs_9Xfoks5rKYpfgaJpZM4LRiqQ .

railsstudent commented 7 years ago

I can open a new issue.