10 lines
447 B
MySQL
10 lines
447 B
MySQL
|
-- Migration 030 — TOTP replay protection.
|
||
|
|
--
|
||
|
|
-- RFC 6238 §5.2 hardening: track the last counter value we accepted for each
|
||
|
|
-- user and reject codes at counters ≤ the last one. Without this, the same
|
||
|
|
-- 6-digit code can be submitted N times within its 30s step. Low impact in
|
||
|
|
-- practice (the code is only valid for ~90s with ±1 drift) but standard.
|
||
|
|
|
||
|
|
ALTER TABLE users
|
||
|
|
ADD COLUMN IF NOT EXISTS totp_last_counter BIGINT NOT NULL DEFAULT 0;
|