Skip to main content

Authentication mechanism absence or evasion - OTP

Need​

Implementation of a robust and secure OTP (One-Time Password) authentication mechanism

Context​

  • Usage of Go 1.15 for building efficient and scalable applications
  • Usage of Gin framework for building web applications in Go

Description​

Non compliant code​

package main

import (
	"github.com/gin-gonic/gin"
)

type User struct {
	PhoneNumber string `json:"phone_number"`
	OTP         string `json:"otp"`
}

func main() {
	r := gin.Default()

	r.POST("/register", func(c *gin.Context) {
		var user User
		if err := c.ShouldBindJSON(&user); err != nil {
			c.JSON(400, gin.H{"error": err.Error()})
			return
		}

		// Send OTP to the user's phone number
		// ...

		// Assume OTP validation is successful
		c.JSON(200, gin.H{"status": "Registration successful"})
	})

	r.Run()
}

In the above code, there is a vulnerability in the registration process. The server receives a POST request at the "/register" endpoint with a JSON payload containing the user's phone number and OTP. However, there is no actual validation of the OTP value received.

The OTP is supposed to be a 6-digit verification code sent to the user's phone number, but any string value is currently accepted, and there is no check for the length of the OTP or its validity. This means that an attacker could bypass the OTP mechanism by simply sending any string in the OTP field.

The lack of OTP validation leaves the application open to attacks where an unauthorized user can register with another user's phone number. This could lead to account takeover or unauthorized access to sensitive information.

Steps​

  • Implement a proper OTP validation mechanism.
  • Ensure that the OTP code is validated against the specified number of digits (6 digits in this case).
  • Verify the OTP code sent by the user during the registration process.
  • If the OTP code is not valid or does not match the expected number of digits, return an appropriate error response.
  • Consider using a secure and reliable OTP generation library or service.
  • Implement rate limiting to prevent brute-force attacks on the OTP verification process.
  • Encrypt and securely store the OTP code to protect it from unauthorized access.
  • Consider implementing additional security measures such as expiration time for the OTP code.

Compliant code​

package main

import (
	"github.com/gin-gonic/gin"
	"net/http"
	"regexp"
)

type User struct {
	PhoneNumber string `json:"phone_number"`
	OTP         string `json:"otp"`
}

var OTPStore = make(map[string]string) // This is a simple in-memory OTP store. Consider using a secure database in production.

func main() {
	r := gin.Default()

	r.POST("/register", func(c *gin.Context) {
		var user User
		if err := c.ShouldBindJSON(&user); err != nil {
			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
			return
		}

		// Generate and send OTP to the user's phone number
		// OTPStore[user.PhoneNumber] = generateOTP()

		// Return a response to indicate that the OTP has been sent
		c.JSON(http.StatusOK, gin.H{"status": "OTP sent"})
	})

	r.POST("/verify", func(c *gin.Context) {
		var user User
		if err := c.ShouldBindJSON(&user); err != nil {
			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
			return
		}

		// Validate the OTP
		if isValidOTP(user.OTP) && OTPStore[user.PhoneNumber] == user.OTP {
			c.JSON(http.StatusOK, gin.H{"status": "Registration successful"})
		} else {
			c.JSON(http.StatusUnauthorized, gin.H{"status": "Invalid OTP"})
		}
	})

	r.Run()
}

func isValidOTP(otp string) bool {
	otpRegex := regexp.MustCompile(`^\\d{6}$`)
	return otpRegex.MatchString(otp)
}

// func generateOTP() string {
// 	// Implement your OTP generation logic here
// }

The updated code now includes a proper OTP validation mechanism.

The /register endpoint generates an OTP and stores it in an in-memory map against the user's phone number. In a production environment, consider using a secure database to store the OTPs.

The /verify endpoint validates the OTP sent by the user. It checks if the OTP is a 6-digit number and if it matches the OTP stored against the user's phone number in the OTPStore.

If the OTP is valid, it returns a success response. If the OTP is invalid or does not match the stored OTP, it returns an "Invalid OTP" error response.

The isValidOTP function uses a regular expression to check if the OTP is a 6-digit number.

The generateOTP function (commented out) is where you should implement your OTP generation logic.

Remember to implement rate limiting to prevent brute-force attacks on the OTP verification process. Also, consider implementing additional security measures such as expiration time for the OTP code.

References​

Last updated on