Authenticator-Extension / Authenticator-Extension/Authenticator

TOTP generation fails when Base32 secret is not properly padded (missing padding handling)

Open
#1,546 1 comment 0 reactions 0 assignees View on GitHub
bug
Dominant language
TypeScript
Stars
4.7k
Forks
1.2k
PR merge metrics
No merged PRs in 30d

Description

### Describe the issue

TOTP generation is unable to handle padding on secret keys that aren't mod 8 via QRCodes.

To reproduce:
- Import TOTP via QR code that isn't mod 8 or is padded to be mod 8
- Compare the generated TOTP with other authenticators (Google, Microsoft, Authy)
- The codes won't match due to missing padding

Example secrets that won't scan correctly:
otpauth://totp/Example:User?secret=J3WWIV3PTGJPQV5QAICM&issuer=Example
otpauth://totp/Example:User?secret=J3WWIV3PTGJPQV5QAICM====&issuer=Example

### Browser

Chrome

### Browser Version

149.0.7827.156

### Extension Version

8.0.2

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reproducing the QR-code import with the two otpauth example URIs, then trace the secret through the import and TOTP generation paths. Compare the generated codes with Google, Microsoft, or Authy for both unpadded and padded secrets; done means the codes match in both cases and the behavior has regression coverage.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
authentication, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
58/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.