Remove usage of alreadyAcceptedCode()/storeAccepedCode() in the TOTP,HOTP, Recovery Code plugins.
TOTP, and HOTP plugins are able to validate a token based on an increasing counter
The Recovery Code plugin removes accepted codes from its configuration once accepted.
Not all configured TOTP tokens will have yet reached this configuration state as it was just added to 8.x-1.3. While initial thoughts would be that we could make an assumption that the users last login time is the latest code used we can’t actually guarantee that as the service_tfa pl ugin may have consumed tokens without updating the user login time. What we can assume is that now() + timeSkew have been used. We could use a mass update hook to use this upper bound.
Site owners would be encouraged to run >=8.x-1.3 for some time with their user base to allow as many accounts as possible to obtain the timeSlice, however if sites use a short time skew (such as the default of 2 which is ~1minute in the future) they may determine on their own that the blackout window is small enough to not be of concern.
N/A
Remove usage of alreadyAcceptedCode()/storeAccepedCode() but leave the methods in the base plugin.
Patch
None
None
Internal only.
Show commandsStart within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
changes
Comments
Comment #3
cmlaraSince 8.x-1.3 has been out for over a year we likely do not need to be as worried about the token window field being present.
Should have a CR for site owners to understand the impact of this change.
Comment #4
cmlaraCR created https://www.drupal.org/node/3527375
A functional test of the update hook is in the branch.
Comment #5
cmlaraFailed to consdier the tfa_service module and older versions mentioned in the IS, as such yes this should still fall back and add a timestamp when one is missing to add immediate protection.
Comment #6
cmlaraComment #7
cmlaraCommitted to Dev on 2.x, no backport due to changing the plugins architecture (generally all internal however API not well defined in 8.x-1.x)