starred/google2fa

Fork 0

mirror of https://github.com/antonioribeiro/google2fa.git synced 2026-04-27 00:55:49 +03:00

[GH-ISSUE #171] verifyKey always fail - simple demo #549

New issue

Closed

opened 2026-03-14 12:10:38 +03:00 by kerem · 1 comment

kerem commented

2026-03-14 12:10:38 +03:00

Owner

Originally created by @dayeggpi on GitHub (Jul 24, 2021).
Original GitHub issue: https://github.com/antonioribeiro/google2fa/issues/171

I am trying to implement a simple page to try this out.
I am able to generate a QR code, and I get the secret code.
I add the QR code to an app, and it works fine.
Then when I try to test the OTP code in order to validate it, it always fails.

Below the code I have.

index.php :


<?php
require_once __DIR__ . '/vendor/autoload.php'; 

use PragmaRX\Google2FA\Google2FA;
use BaconQrCode\Renderer\ImageRenderer;
use BaconQrCode\Renderer\Image\ImagickImageBackEnd;
use BaconQrCode\Renderer\RendererStyle\RendererStyle;
use BaconQrCode\Writer;

$google2fa = new Google2FA();

$g2faUrl = $google2fa->getQRCodeUrl(
    'pragmarx',
    'google2fa@pragmarx.com',
    $google2fa->generateSecretKey()
);

$writer = new Writer(
    new ImageRenderer(
        new RendererStyle(400),
        new ImagickImageBackEnd()
    )
);

$qrcode_image = base64_encode($writer->writeString($g2faUrl));
$secret = $google2fa->generateSecretKey();

?>
<img src="data:image/png;base64, <?php echo $qrcode_image; ?> "/>
<br/>
<?php echo $secret; ?>

I scan the QR code with my app, then I save $secret, keep the page open and open a new tab and go to url verif.php?secret=$secret&code=XXXXXX
with $secret being the $secret from output of index.php and XXXXXX being what the app gives me.

In verif.php I have the following :

<?php
require_once __DIR__ . '/vendor/autoload.php'; 

use PragmaRX\Google2FA\Google2FA;
use BaconQrCode\Renderer\ImageRenderer;
use BaconQrCode\Renderer\Image\ImagickImageBackEnd;
use BaconQrCode\Renderer\RendererStyle\RendererStyle;
use BaconQrCode\Writer;

$google2fa = new Google2FA();

$secret = $_GET['secret'];
$check_this_code = $_GET['code'];

$valid = $google2fa->verifyKey($secret, $check_this_code);
if ($valid) {
$msg = 'ok';}
else 
{$msg='not ok';}
?>
<?php echo $msg; ?>

As there are no clear full code and always small parts of code, I find it difficult to implement.
I am new to that but I am trying.

Thank for your help.

Originally created by @dayeggpi on GitHub (Jul 24, 2021). Original GitHub issue: https://github.com/antonioribeiro/google2fa/issues/171 I am trying to implement a simple page to try this out. I am able to generate a QR code, and I get the secret code. I add the QR code to an app, and it works fine. Then when I try to test the OTP code in order to validate it, it always fails. Below the code I have. index.php : ``` <?php require_once __DIR__ . '/vendor/autoload.php'; use PragmaRX\Google2FA\Google2FA; use BaconQrCode\Renderer\ImageRenderer; use BaconQrCode\Renderer\Image\ImagickImageBackEnd; use BaconQrCode\Renderer\RendererStyle\RendererStyle; use BaconQrCode\Writer; $google2fa = new Google2FA(); $g2faUrl = $google2fa->getQRCodeUrl( 'pragmarx', 'google2fa@pragmarx.com', $google2fa->generateSecretKey() ); $writer = new Writer( new ImageRenderer( new RendererStyle(400), new ImagickImageBackEnd() ) ); $qrcode_image = base64_encode($writer->writeString($g2faUrl)); $secret = $google2fa->generateSecretKey(); ?> <img src="data:image/png;base64, <?php echo $qrcode_image; ?> "/> <br/> <?php echo $secret; ?> ``` I scan the QR code with my app, then I save $secret, keep the page open and open a new tab and go to url verif.php?secret=$secret&code=XXXXXX with $secret being the $secret from output of index.php and XXXXXX being what the app gives me. In verif.php I have the following : ``` <?php require_once __DIR__ . '/vendor/autoload.php'; use PragmaRX\Google2FA\Google2FA; use BaconQrCode\Renderer\ImageRenderer; use BaconQrCode\Renderer\Image\ImagickImageBackEnd; use BaconQrCode\Renderer\RendererStyle\RendererStyle; use BaconQrCode\Writer; $google2fa = new Google2FA(); $secret = $_GET['secret']; $check_this_code = $_GET['code']; $valid = $google2fa->verifyKey($secret, $check_this_code); if ($valid) { $msg = 'ok';} else {$msg='not ok';} ?> <?php echo $msg; ?> ``` As there are no clear full code and always small parts of code, I find it difficult to implement. I am new to that but I am trying. Thank for your help.

kerem closed this issue

2026-03-14 12:10:43 +03:00

kerem commented

2026-03-14 12:10:49 +03:00

Author

Owner

@dayeggpi commented on GitHub (Jul 24, 2021):

my bad....I generate a second time "$secret = $google2fa->generateSecretKey();" which is therefore not the same secret as the QR code...hence it always fails...

changed index.php to the following and it all works better of course.

index.php

<?php

require_once __DIR__ . '/vendor/autoload.php'; 

use PragmaRX\Google2FA\Google2FA;
use BaconQrCode\Renderer\ImageRenderer;
use BaconQrCode\Renderer\Image\ImagickImageBackEnd;
use BaconQrCode\Renderer\RendererStyle\RendererStyle;
use BaconQrCode\Writer;

$google2fa = new Google2FA();
$secret = $google2fa->generateSecretKey(32);
$g2faUrl = $google2fa->getQRCodeUrl(
    'pragmarx',
    'google2fa@pragmarx.com',
    $secret
);

$writer = new Writer(
    new ImageRenderer(
        new RendererStyle(400),
        new ImagickImageBackEnd()
    )
);

$qrcode_image = base64_encode($writer->writeString($g2faUrl));


?>
<img src="data:image/png;base64, <?php echo $qrcode_image; ?> "/>
<br/> 
<?php echo $secret; ?>

@dayeggpi commented on GitHub (Jul 24, 2021): my bad....I generate a second time "$secret = $google2fa->generateSecretKey();" which is therefore not the same secret as the QR code...hence it always fails... changed index.php to the following and it all works better of course. index.php ``` <?php require_once __DIR__ . '/vendor/autoload.php'; use PragmaRX\Google2FA\Google2FA; use BaconQrCode\Renderer\ImageRenderer; use BaconQrCode\Renderer\Image\ImagickImageBackEnd; use BaconQrCode\Renderer\RendererStyle\RendererStyle; use BaconQrCode\Writer; $google2fa = new Google2FA(); $secret = $google2fa->generateSecretKey(32); $g2faUrl = $google2fa->getQRCodeUrl( 'pragmarx', 'google2fa@pragmarx.com', $secret ); $writer = new Writer( new ImageRenderer( new RendererStyle(400), new ImagickImageBackEnd() ) ); $qrcode_image = base64_encode($writer->writeString($g2faUrl)); ?> <img src="data:image/png;base64, <?php echo $qrcode_image; ?> "/> <br/> <?php echo $secret; ?> ```

No labels

bug

pull-request

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/google2fa#549

No description provided.

Rows
Columns