aspnetcore
aspnetcore copied to clipboard
dotnet
ASP.NET Identity Core 2.1 - User can verify multiple times with the same two factor token
Is your feature request related to a problem? Please describe.
When using a UserManager to verify a two factor token (VerifyTwoFactorTokenAsync), the same token can be verified successfully for a user more than once.
This violates Section 5.2 of RFC 6238, in particular,
Note that a prover may send the same OTP inside a given time-step window multiple times to a verifier. The verifier MUST NOT accept the second attempt of the OTP after the successful validation has been issued for the first OTP, which ensures one-time only use of an OTP.
Describe the solution you'd like
Once a token has been verified successfully, VerifyTwoFactorTokenAsync should return false for that token.
Additional context
A work-around we've found is to update a user's security stamp after a successful token verification, but this comes with its own issues, such as invalidating sessions in other browsers. Is there another way we should be doing this?
Oh dear, we're veering from the spec. I've added this to be addressed in the next major release, because it will involve schema changes so it's not something we can do in a patch unfortunately.
Same issue also for UserManager/VerifyChangePhoneNumberTokenAsync - the same phone code can be verified successfuly multiple times.
We've moved this issue to the Backlog milestone. This means that it is not going to be worked on for the coming release. We will reassess the backlog following the current release and consider this item at that time. To learn more about our issue management process and to have better expectation regarding different types of issues you can read our Triage Process.
Per discussion with @blowdart moving this and related issues to backlog for now
I think it is already known, but in addition to the problem you have already highlighted, I have found that OTPs that have expired for much more than 30 seconds are also accepted, which seems quite 'serious' to me for a security system.
Our plan is to add something like "The TOTP should be kept secret because it can be used to authenticate successfully multiple times before it expires.” to https://learn.microsoft.com/en-us/aspnet/core/security/authentication/identity-enable-qrcodes
The TOTP still offers a lot of additional security over just a password even if it can be used multiple times in a 30 second window. If an attacker can read arbitrary network traffic and sniff the TOTP from the form post, they'd usually be better off stealing the authentication cookie that will last a lot longer than 30 seconds.
Hi there! Could you please confirm whether it's possible to delete the user token after it has been used?
