Identity does not validate 8 digit code when two factor authentication is used
- Dominant language
- C#
- Stars
- 38.4k
- Forks
- 10.9k
- Avg merge
- 2d 10h
- Merged PRs (30d)
- 281
Description
### Is there an existing issue for this?
- [X] I have searched the existing issues
### Describe the bug
I want to enable two-factor authentication using 8 digits instead of the default 6.
I am aware that the [Microsoft Authenticator app ](https://www.microsoft.com/en-us/security/mobile-authenticator-app) does not support the `digits` parameter so there is no way for it to generate 8 digit code. However, other apps like [Google Authenticator
](https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2&hl=en_US&gl=US) allows **6** or **8** digit codes.
The issue with Identity is that when **8** digits code is used, the default `AuthenticatorTokenProvider<>` always returns false. It validates correctly only if 6 digits are used.
Perhaps provide a settings where this can be changed to allow for other length.
Some apps allow for 6, 7, 8 or 10 digits. I think these all should be supported.
### Expected Behavior
I expect 8 digits codes to be accepted since some apps are capable of generating 8 digit codes.
### Steps To Reproduce
_No response_
### Exceptions (if any)
_No response_
### .NET Version
.net7
### Anything else?
_No response_
Contributor guide
Research direction
Start by locating AuthenticatorTokenProvider<> and the Identity two-factor token validation path. Determine how token length is currently fixed and identify the relevant Identity tests or entry points; done means supported configured digit lengths, including 8, are accepted without regressing 6-digit validation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- authentication, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100