Comments (4)
I also syncronized the time within the settings of the App
What do you mean with "within the settings of the App"?
Please make sure the clock (time+timezone) on the phone (where the GA-App runs) and the clock (time and timezone) on the server where the PHP script runs are both correct.
If you write down the codes from both instances, do you see the same codes, but time-shifted? Like:
Clock | Phone | Server |
---|---|---|
09:56:00 | 345756 | 199273 |
09:56:30 | 432529 | 725152 |
09:57:00 | 837263 | 561293 |
09:57:30 | 199273 | 236454 |
09:58:00 | 725152 | 448812 |
This for example shows that both clocks are not in sync, they differ by round about 90 seconds. (199273 on the server is generated 90 seconds later on the phone)
from googleauthenticator.
Thanks for the very quick answer,
I also syncronized the time within the settings of the App
In the Google Authenticator App you can tap on the three small dots and then navigate to the settings of the app and there is the option to sync the time.
And yeah both devices my developer laptop and my smartphone got the same timezone and the quite the same time (+- 1-2 sec).
Does it matter that I develop in an IDE called phpStorm and there always run/execute the code manually every 90 sec on the localhost and not on an dedicated server that runs the code everytime or that the IDE maybe has a problem getting the time correct?
The codes aren't timeshifted here a table:
Mobile: Web:
326067 128803
045516 248723
120239 954993
816807 868054
034907 496025
from googleauthenticator.
After thinking about it, I guess I know the problem.
Are you using exactly the script that you posted above? Because with every run of that script, you generate a new $secret. That of causes generates different codes every time you run it.
If you generate a secret for a user, you have to store that secret in a database for example. And the user has to put that secret into his GA-App.
When this user wants to authenticate with the code as a second factor, you have to get the secret from the database for that user, so the server can generate the same token that the GA-App also generates.
In your script, you always create a new secret, so it changes on every run. Then you cannot generate the same code sequence as the GA-App. Both have to know and use the same secret.
For testing: After you generate a secret, put it into your GA-App, and comment out
$secret = $ga->createSecret();
and set
$secret = 'xxxxxxxx';
Then both sides have the same secret, and will generate the same codes at the same time.
from googleauthenticator.
Oh thanks a lot,
this solved the problem.
Such a easy mistake...
Thanks for answering such quick an solving the problem 👍
from googleauthenticator.
Related Issues (20)
- hsusjs
- Verify myself verification information identification HOT 1
- Php authentication with authentication
- Change default secretLength length to 26
- can not log in
- Hello
- Cannot install, missing stable version HOT 2
- Still maintained? HOT 2
- PHP 8.2 issue with `${var}` declarations HOT 1
- [SECURITY] How to Report a Vulnerability? HOT 2
- chart.googleapis.com API deprecated
- recaptcha v2 not work HOT 1
- support config interval?
- Key not recognized
- verifyCode() method could be slightly improved HOT 3
- Still maintained? Or forked with more pull requests/features?
- https://accounts.google.com/signin/v2/identifier?flowName=GlifWebSignIn&flowEntry=ServiceLogin HOT 2
- authenticator key
- Gog
- Can not verify the code generated by Google Authenticator app after deploying the code on the server
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from googleauthenticator.