upcrob/spring-security-otp-test

Temporary test app to demonstrate the spring-security-otp plugin.

spring-security-otp-test's Issues

Sample allows for abuse

Hi!

I'm sure you didn't expect an issue :)

Right now pressing the 'send/generate OTP' button only sends the username, by which the email (or sms) is retrieved.

This allows for easy abuse, someone with just the username of someone would be able to spam them with many OTP mails (or worse, SMS'es, costly!).

I'm trying to set up something similar, but I chose to use two filters, and a temporary ROLE:

1. First filter authenticates on username + password.
2. This also generates and sends the OTP, but only if the password is correct, this makes it a lot harde to abuse.
3. The user now must enter the OTP, which is sent to a second filter, which for a valid OTP updates the roles of the user to the permissions belonging to the user.

Doing things this way seems safer. But admittedly I'm still struggling to get everything right :) Especially what to do in the seconds step, like which Token to use (a OTP token? but then the usernamepassword token is gone), what to do with principal (keep the principal from the first authentication, or get a new principal from the db?), the details (Keep the original WebAuthenticationDetails, or create a new one?).

A proper multi factor authentication library, or Spring security support, would be awesome, so keep it up ;)