Add strict TOTP validation to block invalid authentication requests #578
Conversation
| try: | ||
| print("Enter TOTP: ", end="", flush=True) | ||
| ready, _, _ = select.select([sys.stdin], [], [], timeout_seconds) | ||
| if ready: |
There was a problem hiding this comment.
Should we wait 5mins for the user to enter TOTP?
There was a problem hiding this comment.
Hi Siva, if the user does not provide the TOTP within 5 minutes, the session should expire—meaning the connection between the driver and the server should be terminated.
vertica_python/vertica/connection.py
Outdated
| result = validate_totp_code(totp_input, totp_is_valid=None) | ||
| if not result.ok: | ||
| msg = result.message or INVALID_TOTP_MSG | ||
| print(msg) |
There was a problem hiding this comment.
is this print(msg) for debugging purpose, please remove it
There was a problem hiding this comment.
Hi Siva, I have removed the debug message .
|
MR description did not cover all the issues that addressed. Please update the MR description accordingly. |
vertica_python/vertica/connection.py
Outdated
| INVALID_TOTP_MSG = 'Invalid TOTP: Please enter a valid 6-digit numeric code.' | ||
|
|
||
| if validate_totp_code is not None: | ||
| result = validate_totp_code(self.totp, totp_is_valid=None) |
There was a problem hiding this comment.
validate_totp_code function definition is missing.
There was a problem hiding this comment.
Hi Siva , Added the definition for validate_totp_code.
This MR improves TOTP validation in the Vertica Python driver by enforcing strict 6-digit numeric checks.
Invalid TOTPs (alphanumeric, incorrect length, or with extra spaces) are now blocked locally and return a consistent error message:
“Invalid TOTP: Please enter a valid 6-digit numeric code.”
This prevents invalid authentication requests from being sent to the server and improves user experience.