danvics/warden-worker
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

fix: remove server timestamp in error message for invalid TOTP code to improve security

Browse source
This commit is contained in:
qaz741wsd856 2025-12-31 02:30:38 +00:00
parent 062cec5dfe
commit c82a91e89d
1 changed files with 1 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
src/crypto.rs
View file

@ -252,10 +252,7 @@ pub async fn validate_totp(
} }
} }
Err(AppError::Unauthorized(format!( Err(AppError::Unauthorized("Invalid TOTP code.".to_string()))
"Invalid TOTP code. Server time: {}",
chrono::Utc::now().format("%Y-%m-%d %H:%M:%S UTC")
)))
} }
/// Generates a recovery code (20 characters, Base32 encoded). /// Generates a recovery code (20 characters, Base32 encoded).