ASVS 5.0 V6.5.5 requires out of band authentication requests, codes and tokens, and TOTP codes, to have a defined lifetime. Out of band requests may live at most 10 minutes. TOTP codes may live at most 30 seconds. It is a Level 2 requirement.
Why it matters
The longer a code is valid, the longer it can be phished, intercepted or guessed. A text message code that works for a day is a standing password. Short lives shrink the window in which stolen codes are useful.
How to implement it
Store an expiry with every out of band code and check it on the server.
from datetime import datetime, timedelta, timezone
OOB_TTL = timedelta(minutes=10)
def create_oob(user_id):
code = f"{secrets.randbelow(10**7):07d}"
db.oob.insert(user_id=user_id, code_hash=hash_code(code),
expires_at=datetime.now(timezone.utc) + OOB_TTL)
return code
def check_oob(user_id, code):
row = db.oob.latest(user_id)
return bool(row and row.expires_at > datetime.now(timezone.utc)
and not row.used and verify_hash(row.code_hash, code))
For TOTP, use the standard 30 second step. Allow at most one step of drift either side for clock skew, and note that a window of one step means a code can be accepted for up to about 90 seconds in total, so keep it tight and combine with single use (V6.5.1). Never let the client decide the lifetime.
How to test it
- Request a code, wait 10 minutes and one second, and submit it. It must fail.
- Submit a TOTP from two steps ago and confirm rejection.
- Look for any request parameter that extends validity.
Common mistakes
- Expiry stored in the code or URL where the client can edit it.
- Codes valid for 24 hours "for convenience".
- Wide TOTP windows that accept many steps.
Quick check
Is a 15 minute email code acceptable?
The requirement caps out of band requests at 10 minutes, so 15 minutes fails.
