Authenticator-Extension / Authenticator-Extension/Authenticator
TOTP generation fails when Base32 secret is not properly padded (missing padding handling)
- Dominant language
- TypeScript
- Stars
- 4.7k
- Forks
- 1.2k
- PR merge metrics
- No merged PRs in 30d
Description
### Describe the issue
TOTP generation is unable to handle padding on secret keys that aren't mod 8 via QRCodes.
To reproduce:
- Import TOTP via QR code that isn't mod 8 or is padded to be mod 8
- Compare the generated TOTP with other authenticators (Google, Microsoft, Authy)
- The codes won't match due to missing padding
Example secrets that won't scan correctly:
otpauth://totp/Example:User?secret=J3WWIV3PTGJPQV5QAICM&issuer=Example
otpauth://totp/Example:User?secret=J3WWIV3PTGJPQV5QAICM====&issuer=Example
### Browser
Chrome
### Browser Version
149.0.7827.156
### Extension Version
8.0.2
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reproducing the QR-code import with the two otpauth example URIs, then trace the secret through the import and TOTP generation paths. Compare the generated codes with Google, Microsoft, or Authy for both unpadded and padded secrets; done means the codes match in both cases and the behavior has regression coverage.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 58/100