A simple PHP script to create TOTP secrets and corresponding QR codes,
then verify the entered response over a given time variance.
homepage
documentation
glossary
server
source
Use $auth = new Authenticatron()
to initialize an instance and $auth->new
to create a new secret for a member, and fetch a secure image for scanning.
Code
$auth = new Authenticatron() $auth->new($accountName)
Input
$accountName
is a string containing your members username or nice-name, perferably something unique and quickly identifiable.
Output
Outputs an array, where Secret
is the Secret for the member, URL
is an OTPAuth URL, and QR
is the Data64 URI for the QR code.
array(3) { ["Secret"]=> string(16) "EFR6TM2AK2MHJEEY" ["URL"]=> string(113) "otpauth://totp/Authenticatron Example Page: John Smith?secret=EFR6TM2AK2MHJEEY&issuer=Authenticatron+Example+Page" ["QR"]=> string(814) "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAALQAAAC0AQMAAAAHA5RxAAAABlBMVEUAAAD///+l2Z/dAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAB8ElEQVRYha2XUXLDQAhDdQPuf0vdgCJp449+y5068dvMYBCwLAAMZ2e4s/AH3lXhs/fMXc74iVrfIj9b0JdbukWKH6zyW8B5NmdwoRcoc+BMUl7pocwvbiNJ7v9E0fXFs8Elxr/ry4cGl6G7U8l1MVME72KNK0S03vCyXDxS45tEijeU7sow9LikkUt0ZZx7kp9FfoYpi3LsHDzfrEuJA6nrU2RA632LRT7+SpfcyaJUsOESV0KlcShe7k+jhRZXojqn3DdAVyBZ45JDmtOBg7rqme5xWhO1UyWwd4j8oMSXiZtKLiIReZ8Wj2vqeUjA+OLW4S4217F3TWuk5xZXv4YTbHVzeqHHYSE2HfvM+lteqMKpMqC6kXXR1ib7Ne5mF2OKW8YLFnmaalRxVcB13eL03qPiyNiiFdrfDp93U2a5Jamkk2sdnr5Hb8YWSX2px+Wau/f9Oan4xpYSj84OmdsePBw1+aYYXolMdocahzdlF4V7Br8NtMPfBJTZ1+8hL1Hj2hWe2E7Y2d+81+FK2je4e6LwYDQ9rs9soNZ/+OsbJZ6519pszPmQVuN402/OT+mAzocS97kj55vFZh/yL1s8AxHfWQk5P7W5Znf6+GrxiS5HBiPlboyyx33Oc7Nen0D0WeTuqXgHDyaCOURV+B+78TEycJNWngAAAABJRU5ErkJggg==" }
Handling
You'll want to store ['Secret']
with the member, but make sure you get them to confirm a code before enforcing it, or it might not have worked and they would be locked out of their account. Make sure that this is as protected as a password hash.
['QR']
is the Data64 URI for the QR code. You can simply echo it into an img
element like this:
<img src="<?php echo $secondAuth['QR']; ?>" alt="Second Factor Authentication Code">
Example
Try scanning this into an app like Google Authenticator. You should see a code and a countdown clock until it changes.
Use $auth->checkCode
to confirm the setup and check time-unique codes at every login.
Code
$auth->checkCode($Code, $secret)
Input
$Code
is the user input, the code that is generated on their device for authentication. Should be numeric-only in most cases, alpha-numeric if you change some settings.
$secret
is the secret the member scanned that you securely stored for later.
$Variance
is an optional integer indicating the adjustment of codes with a 30 second value. Defaults to 2 either side, or 1 minute.
Output
Outputs a boolean value, true
if the entered code is within allowed range, false
if not.
bool(true)
Handling
You only need to check an input is alpha-numeric, and maybe 6 characters long before checking it against a retreieved secret.
$secret = ...; if ( strlen($_POST['secondfactor_code']) == 6 && ctype_alnum($_POST['secondfactor_code']) ) { if ( $auth->checkCode($_POST['secondfactor_code'], $secret) ) { // Authenticated, log in... } else { // Incorrect code } } else { // Invalid entry }
Example
Enter the code that your device generates after scanning the image to from Step 1.
Visit our documentation for a more thorough description of the options and functions available to you.
Take a look at the glossary if there are any terms you don't understand.
The server page can be used if this script is installed on your server to check for requirements.
If you're ready to rock, check out the source!
This work is predominantly MIT licensed. See the LICENSE.md file for more information.