[GH-ISSUE #59] Old tokens are valid #262

Closed
opened 2026-03-01 17:48:43 +03:00 by kerem · 4 comments
Owner

Originally created by @ginomessmer on GitHub (Apr 17, 2017).
Original GitHub issue: https://github.com/antonioribeiro/google2fa/issues/59

Verifying old tokens which has been used minutes ago get validated. Is there some way to disable old keys?

Originally created by @ginomessmer on GitHub (Apr 17, 2017). Original GitHub issue: https://github.com/antonioribeiro/google2fa/issues/59 Verifying old tokens which has been used minutes ago get validated. Is there some way to disable old keys?
kerem closed this issue 2026-03-01 17:48:43 +03:00
Author
Owner

@SebastianS90 commented on GitHub (Apr 18, 2017):

Have a look at #50. Maybe I should fork this project because no one seems to be interested in that important feature.

<!-- gh-comment-id:294696892 --> @SebastianS90 commented on GitHub (Apr 18, 2017): Have a look at #50. Maybe I should fork this project because no one seems to be interested in that important feature.
Author
Owner

@ginomessmer commented on GitHub (Apr 18, 2017):

Thanks for heads up. Probably worth to include it, it's a great and yet simple to integrate package though.

<!-- gh-comment-id:294724280 --> @ginomessmer commented on GitHub (Apr 18, 2017): Thanks for heads up. Probably worth to include it, it's a great and yet simple to integrate package though.
Author
Owner

@lukepolo commented on GitHub (Jun 17, 2017):

#50 has been merged! you probably can close this now.

<!-- gh-comment-id:309172143 --> @lukepolo commented on GitHub (Jun 17, 2017): #50 has been merged! you probably can close this now.
Author
Owner

@antonioribeiro commented on GitHub (Jun 17, 2017):

You already had a way to disable them through window, you just have to set window to 1 or even 0:

$isValid = $google2fa->verifyKey($secret, $password, 0);

What https://github.com/antonioribeiro/google2fa/pull/50 gives us is different: you now have the ability to disable passwords already used.

<!-- gh-comment-id:309190706 --> @antonioribeiro commented on GitHub (Jun 17, 2017): You already had a way to disable them through `window`, you just have to set window to 1 or even 0: ``` $isValid = $google2fa->verifyKey($secret, $password, 0); ``` What https://github.com/antonioribeiro/google2fa/pull/50 gives us is different: you now have the ability to disable passwords already used.
Sign in to join this conversation.
No labels
bug
pull-request
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
starred/google2fa#262
No description provided.