WestKeys
Currently building authentication for a mobile app, and the flow goes as follows:
User inputs phone # > User receives TOTP SMS > User inputs TOTP > User is logged in
Would you store TOTP in DB or in memory (ETS or GenServer)?
Where Next?
Trending in Questions
Other Trending Topics
Latest on Elixir Forum
Sponsor Spotlight
Bringing learning, work and compliance together since 1987.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #deployment
- #library
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #elixirconf
- #channels
- #exunit
- #discussion
- #code-sync
- #javascript
- #podcasts
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #elixir-ls
- #blog-post
- #ai
- #phoenix_html
- #elixirconf-us
- #iex
- #graphql
- #genstage
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #processes
- #api
- #forms
- #hex
- #security
- #metaprogramming
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Error tracking, logs, uptime, and Just Enough APM. Built for developers.
Practical resources that improve the lives of professional developers.
Enabling companies to succeed by building software people love.
The deployment platform built for Elixir: PaaS ease, VPS control.
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"
Showing Posts 1 to 10- Show Best Posts
- Show All (oldest first)
- Show All (newest first)
benwilson512
Database. It lets you run multiple versions of your app easily, and if your app goes offline, that doesn’t nuke people’s code.
GenServers / ets are a great way to store ephemeral state or cache values. TOTP codes are short lived but not ephemeral.
WestKeys
That answer was FAST man
Makes sense, follow up question, would you have a separate table for them, or just stick them in the account/user table ?
What’s the difference ?
Exadra37
It means that if you store them in memory and your server goes off or restarts before the user receives the TOPT and inputs it, then the application will not recognize the valid TOPT and the user is forced to repeat the process.
benwilson512
Definitely a separate table. You want to track individual issuances of these codes.
WestKeys
For what purpose ? I naively assumed that even though they would be in a separate table, that they should be cleaned up after verification.
Hmm on second thought, attempt limiting I guess?
benwilson512
Yeah it’s worth cleaning them out eventually but we like to keep them around for customer support and security purposes for a bit. If someone is having issues it’s easier to help if you can see all of their attempts.
hauleth
Why store individual TOTPs at all? " Time-based" in TOTP mean that knowing shared secret you can always generate all past and future tokens, so storing them is pointless.
@WestKeys probably meant OTP not specifically TOTP. TOTP do not need to be stored at all (except the shared secret).
WestKeys
Yes you’re right. Naively assumed OTP’s with an expiry == TOTP.
hauleth
I would highly suggest “real TOTP” instead of SMS based 2FA, as the latter can work even with offline devices. It is also much easier and cheaper to implement.
John-Goff
I have not used it personally but you should check out NimbleTOTP v1.0.0 — Documentation, it seems as though they have implemented most of what you need already. Just store the secret after the user has confirmed it and then you can get codes from an authenticator app or text them to a user yourself.