2FA OTP auth refuses code #3270

New Issue

2025-11-02T05:06:11-06:00

GiteaMirror commented

2025-11-02 05:06:11 -06:00

Originally created by @arren-ru on GitHub (Apr 30, 2019).

Gitea version (or commit ref): 1.8.0
Git version: 2.21.0
Operating system: Archlinux
Database (use [x]):
- PostgreSQL
- MySQL
- MSSQL
- SQLite
Can you reproduce the bug at https://try.gitea.io:
- Yes
- No
- Not relevant
Log gist:

Description

OTP auth refuses codes when registration was completed using early generated code in time window. I mean when next code generation window just started and code appears, this code was used to apply the OTP second factor.

So, when signin procedure requires OTP after login/password it should be done in same manner - early generated code, but it shouldn't be because of large time window. Seems the window in Gitea much smaller than usual 30s or might be shifted.

Screenshots

Originally created by @arren-ru on GitHub (Apr 30, 2019). - Gitea version (or commit ref): 1.8.0 - Git version: 2.21.0 - Operating system: Archlinux - Database (use `[x]`): - [x] PostgreSQL - [ ] MySQL - [ ] MSSQL - [ ] SQLite - Can you reproduce the bug at https://try.gitea.io: - [x] Yes - [ ] No - [ ] Not relevant - Log gist: ## Description OTP auth refuses codes when registration was completed using early generated code in time window. I mean when next code generation window just started and code appears, this code was used to apply the OTP second factor. So, when signin procedure requires OTP after login/password it should be done in same manner - early generated code, but it shouldn't be because of large time window. Seems the window in Gitea much smaller than usual 30s or might be shifted. ## Screenshots ![image](https://user-images.githubusercontent.com/828187/56945322-07dda500-6b51-11e9-8113-75ca8c7d3dfd.png)

GiteaMirror added the issue/needs-feedback label 2025-11-02 05:06:11 -06:00

GiteaMirror closed this issue

2025-11-02 05:06:11 -06:00

GiteaMirror commented

2025-11-02 05:06:12 -06:00

@mdeboer commented on GitHub (Apr 30, 2019):

Silly question maybe but have you checked your time(zone) settings on your server? I use OTP on 1.8.0 and never had any issues.

@mdeboer commented on GitHub (Apr 30, 2019): Silly question maybe but have you checked your time(zone) settings on your server? I use OTP on 1.8.0 and never had any issues.

GiteaMirror commented

2025-11-02 05:06:12 -06:00

@SagePtr commented on GitHub (May 2, 2019):

It's advised to setup NTP on server, so its time will always be close to correct one. And turn on time synchronization on device you use for 2FA.

@SagePtr commented on GitHub (May 2, 2019): It's advised to setup NTP on server, so its time will always be close to correct one. And turn on time synchronization on device you use for 2FA.

GiteaMirror commented

2025-11-02 05:06:12 -06:00