Log only rejected TOTP codes - #187
Closed
janpenitent wants to merge 2 commits into
Closed
Conversation
A rejected TOTP code left no trace, so a clock drift between the client and the server could not be told apart from a wrong or a replayed code. Traces the result, the valid window and the server time; the code itself is never traced.
Logging every validation fills the log with one line per successful login, which on a deployment with many users is noise. Only the failures stay: an invalid code and an already used one, both at warning level, with the code length, the valid window and the server time. A code that passes leaves no trace, and the code itself is never logged.
janpenitent
changed the title
Contributor
Author
|
4.0 is sealed after release: no unreported change goes in. Kept on the fixes/v4.0-* branch in case someone needs it, not for a release. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Logs a rejected TOTP code, both the invalid one and the already used one, with the user, the source IP, the code length, the valid window and the server clock, so support can tell a clock skew apart from a mistyped or reused code; a code that passes leaves no line, and the code itself is never logged.