From c82a91e89daa8924102e2e7f95c27c67698b112b Mon Sep 17 00:00:00 2001
From: qaz741wsd856 <hysth@163.com>
Date: Wed, 31 Dec 2025 02:30:38 +0000
Subject: [PATCH] fix: remove server timestamp in error message for invalid
 TOTP code to improve security

---
 src/crypto.rs | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/src/crypto.rs b/src/crypto.rs
index 27db579..33089be 100644
--- a/src/crypto.rs
+++ b/src/crypto.rs
@@ -252,10 +252,7 @@ pub async fn validate_totp(
         }
     }
 
-    Err(AppError::Unauthorized(format!(
-        "Invalid TOTP code. Server time: {}",
-        chrono::Utc::now().format("%Y-%m-%d %H:%M:%S UTC")
-    )))
+    Err(AppError::Unauthorized("Invalid TOTP code.".to_string()))
 }
 
 /// Generates a recovery code (20 characters, Base32 encoded).