A consumed otp becomes valid again within the drift period

[mnipper]

If an otp is consumed, it becomes invalid during the otp.interval of the instantiated ROTP::TOTP object in TwoFactorAuthenticatable. otp.interval is currently always 30 seconds, since that is the default: https://github.com/mdp/rotp/blob/v3.3.0/lib/rotp/totp.rb#L10

However, during the drift period specified by otp_allowed_drift, the otp again becomes valid.

I believe this is unexpected behavior, and the intention is for an otp to not be reusable within the drift period after it has been consumed.

Here are some specs dropped in here which currently fail:

      context 'given a valid OTP used multiple times within the allowed drift' do
        let(:consumed_otp) { ROTP::TOTP.new(otp_secret).at(Time.now) }

        before do
          subject.validate_and_consume_otp!(consumed_otp)
        end

        context 'after the otp interval' do
          before do
            Timecop.travel(subject.otp.interval.seconds.from_now)
          end

          # This currently fails!
          it 'fails to validate' do
            expect(subject.validate_and_consume_otp!(consumed_otp)).to be false
          end
        end
      end

[asia653]

Can we close this issue because of the merged PR?

[sadgb]

not fixed in master

[alexanderheckel]

Hi, any plans to merge / fix the master branch?

[oliverrauscher]

Hello! I really appreciate this great gem!

Is there any chance that this critical fix will get merged into the master branch soon?

[alexanderheckel]

Hi, any updates on this?

[alexanderheckel]

Hi, any updates on this?

[edwinw6]

The issue can be mitigated by disallowing OTP drift. To do so, add Devise.otp_allowed_drift = 0 to your devise.rb file.

I'm hoping this issue will be patched soon.

[bsedat]

Thank you, this is fixed now in the published version 4.0.2.

[ghost]

Hi,
#108 remains open as a fix for this issue, so could you clarify please if 64576bb is the fixing commit for this issue, as released in 4.0.2, and therefore for https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43177 as well?

Thanks.