{"record":{"id":"14fbe0f8cad29304","repo":"TechnitiumSoftware/DnsServer","slug":"invalid-time-based-one-time-password-totp-was-at-14fbe0","errorCode":null,"errorMessage":"Invalid time-based one-time password (TOTP) was attempted for user: ","messagePattern":"Invalid time-based one-time password \\(TOTP\\) was attempted for user: ","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"DnsServerCore/Auth/User.cs","lineNumber":308,"sourceCode":"\n            return _totpKeyUri;\n        }\n\n        public void EnableTOTP(string totp)\n        {\n            if (_isSsoUser)\n                throw new InvalidOperationException(\"Time-based one-time password (TOTP) feature is not available for SSO users.\");\n\n            if (_totpKeyUri is null)\n                throw new InvalidOperationException(\"Time-based one-time password (TOTP) was not initialized for user: \" + _username);\n\n            if (_totpEnabled)\n                throw new InvalidOperationException(\"Time-based one-time password (TOTP) is already enabled for user: \" + _username);\n\n            Authenticator authenticator = new Authenticator(_totpKeyUri);\n\n            if (!authenticator.IsTOTPValid(totp))\n                throw new Exception(\"Invalid time-based one-time password (TOTP) was attempted for user: \" + _username);\n\n            _totpEnabled = true;\n        }\n\n        public void DisableTOTP()\n        {\n            if (_isSsoUser)\n                throw new InvalidOperationException(\"Time-based one-time password (TOTP) feature is not available for SSO users.\");\n\n            if (!_totpEnabled)\n                throw new InvalidOperationException(\"Time-based one-time password (TOTP) is already disabled for user: \" + _username);\n\n            _totpKeyUri = null;\n            _totpEnabled = false;\n        }\n\n        public void LoggedInFrom(IPAddress remoteAddress)\n        {","sourceCodeStart":290,"sourceCodeEnd":326,"githubUrl":"https://github.com/TechnitiumSoftware/DnsServer/blob/d0484b6c1e7439cdc53d67d81e9c876cda2ad756/DnsServerCore/Auth/User.cs#L290-L326","documentation":"Thrown by User.EnableTOTP(totp) when Authenticator.IsTOTPValid(totp) returns false, i.e. the supplied 6-digit code does not match the TOTP value derived from _totpKeyUri within the current/adjacent time window. Unlike the other guards this is a plain Exception (not InvalidOperationException) because it represents bad user input rather than invalid state. No state is mutated on failure.","triggerScenarios":"The user mistyped the code, the authenticator app and server clocks have drifted beyond the accepted window, the wrong authenticator account was used, or the QR code was scanned by a different app that uses a different algorithm/period.","commonSituations":"Clock skew between the server and the device; the user scanned the QR for a different account; T0/period mismatch from a non-standard authenticator; copy-paste truncation of the code.","solutions":["Have the user re-enter the code carefully from the authenticator app.","Ensure server time is correct (NTP) and within the RFC 6238 tolerance window.","Re-run InitializedTOTP to get a fresh QR and re-scan, confirming the app supports SHA-1/30s defaults."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try\n{\n    user.EnableTOTP(totpCode);\n}\ncatch (Exception ex) when (ex.Message.Contains(\"Invalid time-based one-time password\"))\n{\n    return BadRequest(\"The TOTP code was incorrect or expired. Please re-enter it from your authenticator app.\");\n}","preventionTips":["Keep server time synchronized via NTP to stay within the TOTP window.","Let the user re-enter the code on failure rather than locking them out immediately.","Verify the authenticator app uses the standard 30s/SHA-1 defaults matching the key URI."],"tags":["auth","totp","mfa","validation","clock-skew","technitium-dns-server"],"backgroundTag":null,"analyzedSha":"d0484b6c1e7439cdc53d67d81e9c876cda2ad756","analyzedAt":"2026-08-13T22:57:35.508Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}