search

wisespace-io / yubico-rs

Yubikey client API library, Challenge-Response & Configuration
Other
52 stars 13 forks source link

Panic when Caller Exits Early when Verifying OTP Against Multiple Servers #4

Closed Step7750 closed 6 years ago

Step7750 commented 6 years ago

When verifying against multiple OTP servers, the caller may exit before other threads finish, and as a result, will call an invalid channel Sender that no longer exists and panic.

This is due to how (according to spec) it sends out 5 requests simultaneously to the default YubiCloud servers, and if one of the threads returns that the OTP is ok, it will immediately return the result to calling code. Unfortunately, after the verify caller exits, the other threads will still be alive and will receive responses and attempt to send then back to the caller through a channel that no longer exists and will panic.

A way to tackle it would be forcibly quitting all other threads once one has returned successfully.

wisespace-io commented 6 years ago

@Step7750 I published a new version with a fix. Thank you for reporting it. I will read the spec again when I have more time and change a bit the way the lib is handling the responses.