dotnet / dotnet/aspnetcore

Identity does not validate 8 digit code when two factor authentication is used

Open
#48,317 1 comment 0 reactions 0 assignees View on GitHub
area-identity enhancement
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 10h
Merged PRs (30d)
281

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Describe the bug

I want to enable two-factor authentication using 8 digits instead of the default 6.

I am aware that the [Microsoft Authenticator app ](https://www.microsoft.com/en-us/security/mobile-authenticator-app) does not support the `digits` parameter so there is no way for it to generate 8 digit code. However, other apps like [Google Authenticator
](https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2&hl=en_US&gl=US) allows **6** or **8** digit codes.

The issue with Identity is that when **8** digits code is used, the default `AuthenticatorTokenProvider<>` always returns false. It validates correctly only if 6 digits are used.

Perhaps provide a settings where this can be changed to allow for other length.

Some apps allow for 6, 7, 8 or 10 digits. I think these all should be supported.

### Expected Behavior

I expect 8 digits codes to be accepted since some apps are capable of generating 8 digit codes.

### Steps To Reproduce

_No response_

### Exceptions (if any)

_No response_

### .NET Version

.net7

### Anything else?

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by locating AuthenticatorTokenProvider<> and the Identity two-factor token validation path. Determine how token length is currently fixed and identify the relevant Identity tests or entry points; done means supported configured digit lengths, including 8, are accepted without regressing 6-digit validation.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
authentication, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.