ACME HQDemo work items and pages, made up for Emargen's demo. Not a real company.
Engineering / ENG-1483

TOTP codes refused when the phone's clock is 40 s off

Project
Engineering
Type
Bug
Status
Done Done
Priority
High
Reporter
Mira Holm <mira.holm@acme-hq.example>
Assignee
Marek Nowak <marek.nowak@acme-hq.example>
Labels
securitymfa
Components
identity-service
Fix versions
identity-service 2026.06.08
Sprint
Sprint 44
Parent
ENG-1431 MFA for administrators
Created
5 Jun 2026, 12:30 UTC
Updated
8 Jun 2026, 14:00 UTC
Resolved
8 Jun 2026, 14:00 UTC

Description

Testing with a cheap Android phone whose clock runs 40 s behind: every code is refused.

Steps to reproduce

  1. Set a phone's clock 40 s behind. Set up MFA.
  2. Sign in with the code shown.

Expected: accepted. Actual: "That code didn't work."

We accept only the current 30 s step. Accept one step either side, and refuse a code already used in that window.

Comments (1)

Marek Nowak · 8 Jun 2026, 14:00 UTC

±1 step plus a replay check. Test added with a frozen clock.