Feature: add a 30 seconds grace window for 2-factor token checks

2018-05-15 16:13:21 -07:00 · 2018-05-15 16:13:21 -07:00 · 74aecdfd9d
parent 19605e8b0b
commit 74aecdfd9d
1 changed files with 1 additions and 1 deletions
--- a/app/models/concerns/second_factor_manager.rb
+++ b/app/models/concerns/second_factor_manager.rb
@ -27,7 +27,7 @@ module SecondFactorManager
      last_used = self.user_second_factor.last_used.to_i
    end

-    authenticated = !token.blank? && totp.verify_with_drift_and_prior(token, 0, last_used)
+    authenticated = !token.blank? && totp.verify_with_drift_and_prior(token, 30, last_used)
    self.user_second_factor.update!(last_used: DateTime.now) if authenticated
    !!authenticated
  end