ValidateTotp Issue
- Dominant language
- C#
- Stars
- 1.3k
- Forks
- 179
- PR merge metrics
- No merged PRs in 30d
Description
Can some please help with this as i am stuck really.
If i create the QRcode and set it up with an authnticator the validate all works fine.
However if i generate the secret and store this, then use it to create a TOTP and try to validate this, it always fails?
I want to use email validation as well as an authenticator app.
So i am generating an email with the totp created using the stored secret, but it fails validation.
Can some please help or point me in the right direction with this?
public class TotpManager : ITotpManager
{
private readonly string _qrCodeImagePrefix = "data:image/png;base64,";
private readonly string _totpAuthPrefix = "otpauth://totp/";
public string GenerateBase32Secret()
{
var bytes = KeyGeneration.GenerateRandomKey(20);
return Base32Encoding.ToString(bytes);
}
public string GenerateTotp(string base32Secret)
{
var secretBytes = Base32Encoding.ToBytes(base32Secret);
var totp = new Totp(secretBytes);
return totp.ComputeTotp();
}
public string GenerateTotp(string base32Secret, int step)
{
var secretBytes = Base32Encoding.ToBytes(base32Secret);
var totp = new Totp(secretBytes, step);
return totp.ComputeTotp();
}
public bool ValidateTotp(string base32Secret, string totp)
{
var secretBytes = Base32Encoding.ToBytes(base32Secret);
var totpValidator = new Totp(secretBytes);
return totpValidator.VerifyTotp(totp, out _);
}
public string GenerateQrCodeUrl(string issuer, string accountName, string base32Secret)
{
string totpUrl =
$"{_totpAuthPrefix}{Uri.EscapeDataString(issuer)}:{Uri.EscapeDataString(accountName)}?secret={base32Secret}&issuer={Uri.EscapeDataString(issuer)}&algorithm=SHA1&digits=6&period=30";
var qrGenerator = new QRCodeGenerator();
var qrCodeData = qrGenerator.CreateQrCode(totpUrl, QRCodeGenerator.ECCLevel.Q);
var qrCode = new QRCode(qrCodeData);
using MemoryStream ms = new MemoryStream();
using Bitmap qrCodeImage = qrCode.GetGraphic(20);
qrCodeImage.Save(ms, ImageFormat.Png);
byte[] qrCodeBytes = ms.ToArray();
return $"{_qrCodeImagePrefix}{Convert.ToBase64String(qrCodeBytes)}";
}
}
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with the TotpManager methods shown in the issue, comparing GenerateTotp(string base32Secret) with ValidateTotp(string base32Secret, string totp) and the Totp VerifyTotp entry point. Reproduce the stored-secret and email-code path, then determine the input or configuration mismatch that causes validation to fail; no repository file or test is named.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100