mirror of
https://github.com/BookStackApp/BookStack.git
synced 2026-02-08 19:06:06 +03:00
"The provided code is not valid or has expired." #3902
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @b3nd1k on GitHub (Jul 5, 2023).
Attempted Debugging
Searched GitHub Issues
Describe the Scenario
I haven't logged into Bookstack for a few weeks and when I tried to log in today I get a message saying "The provided code is not valid or has expired" when I input the 2FA code generated by Bitwarden. It has worked fine up until now, but now I am not able to log in.
It doesen't seem to be that Bitwarden has messed with my 2FA codes either as BookStack seems to be the only app I have issues with. Is there a way for me to edit a text file to disable 2FA or do something else to gain access?
Exact BookStack Version
latest
Log Content
No errors in the log
PHP Version
Unsure
Hosting Environment
Docker on Unraid Server
@ssddanbrown commented on GitHub (Jul 5, 2023):
Hi @b3nd1k,
This is most commonly caused by the BookStack host time not being current, since TOTP MFA codes are time dependant.
It'd be worth checking the time within the docker container to check if it's correct.
For resetting MFA, we provide a command as detailed here:
https://www.bookstackapp.com/docs/admin/commands/#reset-user-mfa-methods
@ssddanbrown commented on GitHub (Jul 18, 2023):
Since there's been no further follow up or response to the above I'll close this off.
@alexanderharm commented on GitHub (Oct 18, 2023):
I had the same issue with Bitwarden. I solved it by just copying the secret of the provided URL. So instead of using
otpauth://totp/BookStack:admin%40admin.com?secret=ABCDEFGHIJKLMN&issuer=BookStack&algorithm=SHA1&digits=6&period=30I simply used
ABCDEFGHIJKLMN. Then it worked.Just make sure you setup the time correctly as well (
APP_TIMEZONE).@kekonn commented on GitHub (Apr 4, 2024):
This worked for me as well!
@ssddanbrown sorry to ping you from an old issue, but the QR code and URL you generate seem to be incompatible with Bitwarden. If I just copy the secret part of the url into Bitwarden, my code is accepted. If I copy the entire url, it is not.
I also tried scanning the generated QR code, but the Bitwarden app won't even recognize it as a TOTP code. I did a quick google search to see if Bitwarden specifies the format it expects, but couldn't find it.
@ssddanbrown commented on GitHub (Apr 4, 2024):
@kekonn If you can find something wrong with our use of standards, that is affecting bitwarden feel free to raise that as an issue but otherwise it's not something I test against since I don't have a bitwarden account, plus TOTP appears to be a premium feature for bitwarden so I'm not keen to pay to test their implementation.
@kekonn commented on GitHub (Apr 4, 2024):
Oh no, I am pretty sure this one is on Bitwarden, but the workaround we've found here, might be worth mentioning in your documentation. I do have Bitwarden premium and I think I log a support ticket for this with them.