magespecialist/m2-MSP_TwoFactorAuth

Some authenticator apps say invalid URL

Closed this issue · 2 comments

peterjaap commented

Sometimes the QR code generated will not validate. 1Password One Time Password does read the QR code but will generate an invalid code every time. Google Authenticator will give an invalid url warning;

image

We tracked it down to the secret being a base32 hash and thus containing three = at the end of the string. The created otpauth:// will then be invalid for some authenticator apps in some situations.

The fix is to strip out the special characters, thereby generating a valid oauth url everytime.

peterjaap commented

See PR #7

phoenix128 commented

Thank you for your Merge Request, it fixed this issue.