I know you suggested more constructor arguments, but after implementing and trying to use, I saw it wouldn't make much sense... Also, I understood you wanted to keep the original constructor as-is, with the logo being a deliberately and rare optional choice.

Thus, the method suits just fine, keeping everything at the same place, being less verbose and less bloated (otherwise a common call + logo would need to skip-guess all the default parameters, such as colors, margin, correction level...).

P.S.: I'd suggest creating a new release! The two external providers are only available in master.

To assist with #37 and also to improve my own project, I have written a provider for BaconQrCode.

I have used the current version which relies on PHP 7.1 at minimum. It is also possible to customise the QR code slightly.

Usage:

$provider = new \RobThree\Auth\Providers\Qr\BaconQrCodeProvider();
$provider->setBorderWidth(1);
$provider->setBackgroundColour('#d0d0d0');
$provider->setForegroundColour('#333');

$twoFa = new TwoFactorAuth($issuer, 6, 30, 'sha1', $provider);

// works with standard usage
$twoFa->getQRCodeImageAsDataUri($label, $secret, 400);

// also access an SVG
$provider->getQRCodeSvg($twoFa->getQRText($label, $secret), 400);

As an aside, would you consider allowing setters in the main TwoFactorAuth class to allow setting the providers without declaring all the other options in the constructor?

Hello, I was trying to implement your library into my project. The QR Code as well as the Code are being generated properly but I can't verify the Code.

After looking at the code I thought about, that the Time could be an issue. After trying the code try { $tfa->ensureCorrectTime(); echo 'Your hosts time seems to be correct / within margin'; } catch (RobThree\Auth\TwoFactorAuthException $ex) { echo '<b>Warning:</b> Your hosts time seems to be off: ' . $ex->getMessage(); }

I get the following error Uncaught Exception: Connection refused extern/lib/Providers/Time/NTPTimeProvider.php Zeile 40 Backtrace #0 extern/lib/TwoFactorAuth.php(157): RobThree\Auth\Providers\Time\NTPTimeProvider->getTime() #1 extern/2fa.php(39): RobThree\Auth\TwoFactorAuth->ensureCorrectTime() #2 {main}

NTPTimeProvider.php /* Receive response and close socket */ if (socket_recv($sock, $recv, 48, MSG_WAITALL) === false) throw new \Exception(socket_strerror(socket_last_error($sock))); socket_close($sock);

So it's probably an Time issue I can't verify.

Also do I set the discrepancy in the TwoFactorAuth.php like this public function verifyCode($secret, $code, $discrepancy = 4, $time = null, &$timeslice = 0)

or in my file with $Ergebnis= $tfa->verifyCode($secret, $_POST['verification'], $discrepancy);

Many regards Lukas

Hello,

I have been using your library in production for a couple of years now with no issue. We have had a bug come in where a user moving from non-2FA to 2FA could not get their code to verify. There is no issue with existing users verifying already set up codes.

I could reproduce this on production where neither the barcode nor the generated code would generate me an accepting code. I cannot reproduce it locally. I have also found that it works perfectly on our demo environment but the same problem occurs on our test/staging environment.

All servers are running robthree/twofactorauth version 1.8. All servers are running PHP 7.4 though there are minor differences between minor versions PHP 7.4.27 (ubuntu 18) where the issuing is occurring, PHP 7.4.14 (ubuntu 18), 7.4.16 (windows 10) where the problem doesn't appear.

I have tried swapping out IRNGProvider and constructing with HttpTimeProvider, all of which work beautifully on the already working environments but return false from TwoFactorAuth::verifyCode on the affected environments.

I am struggling to think what I could be missing, some php packages that are required but not installed on the affecting environments? I would have hoped that any changes in the way underlying PHP functions (thinking random_bytes) work would have bene ruled out by swapping out Providers.

Any thoughts on this appreciated or indeed any "this is not enough info! we require x,y and z to help"- I've not bothered with code samples since the codes does work on "good" environments and the code itself is consistent across the environments. I just can't think what environmental component I may be missing that would explain the behaviour of existing codes verifying but newly generated ones not.

I have migrated my website to a new server.

Now the 2fa verification always fails (verifyCode returns 0);

How can I find out why and how to solve it? I don't want all my users to set it up again....

What changed: Moved from php 7.4 to php 8.0.25 Moved from utf8 to utf8mb4 Moved to a different timezone

I write this hesitatingly as I'm not convinced that this is an issue with this code or not, but would like to throw out issues that we've started experiencing over the past few weeks. We use this library (1.7.0)to generate and authenticate using a QR code only but have experienced the following when using Google Authenticator (GA), Microsoft Authenticator (MA) and Duo (D).

1. If a user is using an Android phone, GA, MA and D all work flawlessly when presented with the QR code and entering the PIN.
2. If a user is using an IOS phone, then GA regularly has issues. MA and D work OK

Due to (2) we've been using both an IOS and Android based device to scan the same QR code, and using all three authenticators. The results are haphazard and don't appear to be following any logic, but we experience

1. Sometimes IOS with GA manages to scan the code without any issues at all
2. Sometimes IOS with GA scans the QR code but when entering in the same PIN as Android shows, the PIN gets rejected
3. Sometimes IOS with GA scans the QR code but shows a completely different PIN as the Android does

All servers have NTP configured and checks no more than every 30 sec intervals. The devices themselves are configured in the same timezone and we've confirmed that their system times are within 1sec of each other.

So - I'm at a bit of a loss. I appreciate that we're not using the latest version but I find it odd that all of a sudden we've started seeing these issues. Yes I appreciate that it might be a problem with GA, but thought I would check in here first to see if this was a known issue (I didn't find anything) and there's nothing like getting advice from the horses' mouth, as it were.

Am loving the fact that this is so easy to use, many congratulations sir.

I have one question regarding the MyProvider.php class location when using PHPQRCode as per qr-code-providers

1. I've placed the phpqrcode.php file in the same (composer) folder as TwoFactorAuth.php (./vendor/robthree/twofactorauth/lib)

2. I've created the MyProvider.php file in the Providers/Qr folder (./vendor/robthree/twofactorauth/lib/Providers/Qr/MyProvider.php).

   1. The notes refer to that file named as myprovider.php when creating it, but I believe it should be MyProvider.php?
   2. I also believe that the namespace should be placed above the require/require_once?

3. I've then taken your demo page, added my composer autoload.php to it and tried to get it working, but every time I attempt to run it, I get a missing phpqrcode.php file

Warning: require_once(../../phpqrcode.php): failed to open stream: No such file or directory in /var/www/vendor/robthree/twofactorauth/lib/Providers/Qr/MyProvider.php on line 3

Fatal error: require_once(): Failed opening required '../../phpqrcode.php' (include_path='.:/usr/share/php:/var/www/html/inc') in /var/www/vendor/robthree/twofactorauth/lib/Providers/Qr/MyProvider.php on line 3

• Am I missing something really obvious here?

• Should I not have placed those files in the vendor folder, but elsewhere in my application?

• I've attached a screenshot of my vendor folder structure in the hope that assists?

Closes #82

This PR adds compatibility with endroid/qr-code:^4 while maintaining support for older versions.

Test code:

<?php

use RobThree\Auth\Providers\Qr\EndroidQrCodeProvider;
use RobThree\Auth\Providers\Qr\EndroidQrCodeWithLogoProvider;

require_once(__DIR__ . '/vendor/autoload.php');

$filename = method_exists(\Endroid\QrCode\QrCode::class, 'create') ? 'test2.png' : 'test1.png';

$provider = new EndroidQrCodeProvider();
file_put_contents(__DIR__ . '/' . $filename, $provider->getQRCodeImage('foobar', 80));

$provider2 = new EndroidQrCodeWithLogoProvider();
$provider2->setLogo(__DIR__ . '/logo.jpeg', [30, 30]);
file_put_contents(__DIR__ . '/logo-' . $filename, $provider2->getQRCodeImage('foobar', 80));

logo.jpeg:

endroid/qr-code:^3 results:

endroid/qr-code:^4 result:

I like this library. I have implemented TFA in my application and in all my tests, it seemed to work just fine.

I was testing with a couple of different iPhones using the Google Authenticator app, very straightforward.

However, upon deploying, the first user was using an older android phone. She installed Authenticator and took the picture of the QR. It 'seemed' to work, but Authenticator was showing a 6 digit code with a 30 seconds timeout (I have configured for an 8 digit code with a 1 minute timeout). Of course, the code does not work.

Has anybody seen anything similar? Are there different versions of Google Authenticator (there didn't seem to be when we installed it) I should be aware of?

Suggestions appreciated, we're 95% there!

Thanks for all the work on this!

I've copied the demo into a laravel 5.1 view. Every time i load the page i get this line

When aforementioned code (893875) was entered, the result would be: FAIL

Obviously each time i refresh the code changes but it still fails. Only change i made in the demo was to remove

require_once 'loader.php';
Loader::register('../lib','RobThree\\Auth');

Since laravel will load the package.

By forcing $this->issuer to be string, even if null is set, it prevents throwing errors in PHP 8.1 is rawurlencode is not allowed to have null as parameter.

It would be better to force string to be already in __construct, but this may create a breaking change for existing users.

As discussed in #63, here is a set of changes to bring this lib into modern PHP.

I'll leave this as a draft for now, as it's not 100% complete, but this gives you an opportunity to start the review process and leave comments.

~Nico

Firstly, thanks for this library, very useful and easy to use.

When I initialize the class and specify a name ( i.e. $tfa = new TwoFactorAuth('My App'); ) MS Authenticator doesn't seem to apply this and uses the domain name of the email address as the account name on its authenticator app.

On the other hand, Google Authenticator works fine with this.

Any ideas?

Hello,

First, thank you for providing this library, I use it in my project: eLabFTW: the open source lab notebook :heart:

I see that the minimum version for php is 5.6. Does it really makes sense to support a version that has been out of the game for 2 years now?

See my arguments:

By requiring a modern php version you push admins to update their stack and increase global internet security ®, but more importantly you can move forward with your codebase and use modern features (that are not even new anymore) and make your life easier as a developer.

With that you open the door to better static analysis, and (this is why I'm here) users of the library can also type hint properly their code. My codebase is fully typed, except for getQRCodeImage ;)

Also, if users are still using php 5.6, it's quite unlikely that they regularly update their dependencies, so the argument of "but there are still people using 5.6 out there!" is moot IMHO. In the era of containers, one has no valid excuse for keeping around old php versions (except time and money of course, but that's another debate).

Please kindly indicate what are your reasons for supporting old php versions and if you'd consider dropping old versions in order to allow yourself and contributors to improve gradually the codebase with modern php language constructs, operators and features (and incidently, allow me to full type hint my code ;) ).

I'm willing to contribute to this work with PRs.

Best, ~Nico

PS: this blog post is an interesting read

Feature added

Added Image support for FreeOPT as explained on this StackOverflow answer: https://stackoverflow.com/a/50410063

Feature test

Feature tested on FreeOTP and works as expected. Also tested on Microsoft Authenticator, Authy and Google Authenticator to check that still works on authenticators that do not suport the image parameter.

Test were made on Android versions only