Merge pull request #11 from joergschulz/master

verify(): use formatted strings instead of bytes
authlib · Sep 9, 2023 · b0847d4 · b0847d4
2 parents 22368eb + 73ca0f3
commit b0847d4
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/src/otpauth/rfc4226.py b/src/otpauth/rfc4226.py
@@ -35,7 +35,7 @@ def verify(self, code: int, counter: int) -> bool:  # type: ignore[override]
         """
         if len(str(code)) > self.digit:
             return False
-        return hmac.compare_digest(bytes(self.generate(counter)), bytes(code))
+        return hmac.compare_digest(f'{self.generate(counter):0{self.digit}}', f'{code:0{self.digit}}')
 
     def to_uri(self, label: str, issuer: str, counter: int) -> str:  # type: ignore[override]
         """Generate the otpauth protocal string for HOTP.

diff --git a/src/otpauth/rfc6238.py b/src/otpauth/rfc6238.py
@@ -40,7 +40,7 @@ def verify(self, code: int, timestamp: t.Optional[int] = None) -> bool:  # type:
         """
         if len(str(code)) > self.digit:
             return False
-        return hmac.compare_digest(bytes(self.generate(timestamp)), bytes(code))
+        return hmac.compare_digest(f'{self.generate(timestamp):0{self.digit}}', f'{code:0{self.digit}}')
 
     def to_uri(self, label: str, issuer: str) -> str:  # type: ignore[override]
         """Generate the otpauth protocal string for TOTP.