{"action":"created","issue":{"url":"https://api.github.com/repos/tinfoil/devise-two-factor/issues/106","repository_url":"https://api.github.com/repos/tinfoil/devise-two-factor","labels_url":"https://api.github.com/repos/tinfoil/devise-two-factor/issues/106/labels{/name}","comments_url":"https://api.github.com/repos/tinfoil/devise-two-factor/issues/106/comments","events_url":"https://api.github.com/repos/tinfoil/devise-two-factor/issues/106/events","html_url":"https://github.com/tinfoil/devise-two-factor/issues/106","id":212571947,"node_id":"MDU6SXNzdWUyMTI1NzE5NDc=","number":106,"title":"A consumed otp becomes valid again within the drift period","user":{"login":"mnipper","id":1945379,"node_id":"MDQ6VXNlcjE5NDUzNzk=","avatar_url":"https://avatars1.githubusercontent.com/u/1945379?v=4","gravatar_id":"","url":"https://api.github.com/users/mnipper","html_url":"https://github.com/mnipper","followers_url":"https://api.github.com/users/mnipper/followers","following_url":"https://api.github.com/users/mnipper/following{/other_user}","gists_url":"https://api.github.com/users/mnipper/gists{/gist_id}","starred_url":"https://api.github.com/users/mnipper/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mnipper/subscriptions","organizations_url":"https://api.github.com/users/mnipper/orgs","repos_url":"https://api.github.com/users/mnipper/repos","events_url":"https://api.github.com/users/mnipper/events{/privacy}","received_events_url":"https://api.github.com/users/mnipper/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2017-03-07T21:58:24Z","updated_at":"2018-08-16T23:04:53Z","closed_at":null,"author_association":"NONE","body":"If an otp is consumed, it becomes invalid during the `otp.interval` of the instantiated `ROTP::TOTP` object in TwoFactorAuthenticatable.  `otp.interval` is currently always 30 seconds, since that is the default: https://github.com/mdp/rotp/blob/v3.3.0/lib/rotp/totp.rb#L10\r\n\r\nHowever, during the drift period specified by `otp_allowed_drift`, the otp again becomes valid.\r\n\r\nI believe this is unexpected behavior, and the intention is for an otp to not be reusable within the drift period after it has been consumed.\r\n\r\nHere are some specs dropped in [here](https://github.com/tinfoil/devise-two-factor/blob/v3.0.0/lib/devise_two_factor/spec_helpers/two_factor_authenticatable_shared_examples.rb#L67) which currently fail:\r\n```\r\n      context 'given a valid OTP used multiple times within the allowed drift' do\r\n        let(:consumed_otp) { ROTP::TOTP.new(otp_secret).at(Time.now) }\r\n\r\n        before do\r\n          subject.validate_and_consume_otp!(consumed_otp)\r\n        end\r\n\r\n        context 'after the otp interval' do\r\n          before do\r\n            Timecop.travel(subject.otp.interval.seconds.from_now)\r\n          end\r\n\r\n          # This currently fails!\r\n          it 'fails to validate' do\r\n            expect(subject.validate_and_consume_otp!(consumed_otp)).to be false\r\n          end\r\n        end\r\n      end\r\n```"},"comment":{"url":"https://api.github.com/repos/tinfoil/devise-two-factor/issues/comments/413710199","html_url":"https://github.com/tinfoil/devise-two-factor/issues/106#issuecomment-413710199","issue_url":"https://api.github.com/repos/tinfoil/devise-two-factor/issues/106","id":413710199,"node_id":"MDEyOklzc3VlQ29tbWVudDQxMzcxMDE5OQ==","user":{"login":"Edwardzyc","id":2181584,"node_id":"MDQ6VXNlcjIxODE1ODQ=","avatar_url":"https://avatars0.githubusercontent.com/u/2181584?v=4","gravatar_id":"","url":"https://api.github.com/users/Edwardzyc","html_url":"https://github.com/Edwardzyc","followers_url":"https://api.github.com/users/Edwardzyc/followers","following_url":"https://api.github.com/users/Edwardzyc/following{/other_user}","gists_url":"https://api.github.com/users/Edwardzyc/gists{/gist_id}","starred_url":"https://api.github.com/users/Edwardzyc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Edwardzyc/subscriptions","organizations_url":"https://api.github.com/users/Edwardzyc/orgs","repos_url":"https://api.github.com/users/Edwardzyc/repos","events_url":"https://api.github.com/users/Edwardzyc/events{/privacy}","received_events_url":"https://api.github.com/users/Edwardzyc/received_events","type":"User","site_admin":false},"created_at":"2018-08-16T23:04:53Z","updated_at":"2018-08-16T23:04:53Z","author_association":"NONE","body":"Can we close this issue because of the merged PR?"}}
{"actor":{"display_login":"Edwardzyc"}}