classyk12 / classyk12/ProjectR.Backend

OTP Code Resend Mechanism

Open
#13 0 comments 0 reactions 1 assignee Claimed by @classyk12 View on GitHub
enhancement good first issue security
Dominant language
C#
Stars
6
Forks
6
PR merge metrics
No merged PRs in 30d

Description

### Description

Add a robust and secure OTP resend mechanism to complement the OTP code generator feature. This will allow users to request a new OTP if the previous one expires or is not received, while protecting the system from abuse (e.g., spamming resend requests).

### Acceptance Criteria

1. Controller Endpoint to trigger OTP resend: POST /auth/resend-otp
2. Validate phoneNumber before sending
3. Limit resend attempts (e.g., max 3 within 10 minutes)
4. Use same OTP if still valid; generate a new one only if expired
5. Store/send via preferred channel (WhatsApp).

### Suggested Implementation

- Add a ResendOtpRequest DTO
- Extend existing OtpService with ResendOtpAsync(phoneNumber)
- Use timestamp tracking to throttle excessive requests
- Consider integrating Redis for rate-limiting
- Unit test different edge cases: expired OTP, excessive requests, etc.

Feel free to drop a comment if you need clarification

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.