NAME

RT::MFA::TOTP - TOTP multi-factor authentication helpers

GenerateSecret

Returns a new random base32-encoded TOTP shared secret.

QRCodeURI Secret => $secret, User => $user_obj

Returns the otpauth://totp/... URI for use with authenticator apps. Uses RT's site name as the issuer and the user's email address (or Name if no email) as the account identifier.

QRCodeSVG Secret => $secret, User => $user_obj

Returns the QR code as inline SVG markup (a <svg>...</svg> string) suitable for embedding directly in an HTML page. The otpauth:// URI is encoded into the QR modules, not into any attribute, so the markup contains no user-supplied values.

VerifyCode Secret => $secret, Code => $code, Drift => $n, User => $user_obj

Verifies a 6-digit TOTP code against the given base32 secret. Drift is the number of 30-second TOTP windows accepted on each side of the current step (default: 0, meaning only the current window). Use 1 to also accept one window before and one after, 2 for two in each direction, etc. Maximum allowed value is 5 (equivalent to a total of 11 accepted windows).

When User is provided, the method also enforces replay protection by tracking the time window of the last successfully used code. Any code whose matching window is at or before the last-used window is rejected, preventing reuse even when multiple codes are valid simultaneously due to the drift setting.

Returns true if the code is valid, false otherwise.

← Back to index