Forum Discussion

JWhitesPro_1928's avatar
JWhitesPro_1928
Icon for Cirrostratus rankCirrostratus
Jan 26, 2016

OTP can be bypassed by refreshing on the OTP prompt page..

Has anyone ran into this issue?   On 11.6HF6   If you're at a step in your access policy of prompting for a OTP and the user just refreshes the browser, it bypasses everything else in the polic...
BIG-IP Access Policy Manager (APM)
security
JWhitesPro_1928's avatar
JWhitesPro_1928
Icon for Cirrostratus rankCirrostratus

I think it may be a bug...as I said it doesn't happen on mobile devices--and in the logs I see this right before it goes on to allow the user through even though they typed nothing in.

 

modules/Authentication/OTP/OTPVerifyAgent.cpp func: "getOTPVerifyUserInput()" line: 149 Msg: 64d04990: OTP_VERIFY Agent: getOTPVerifyUserInput(): unable to decrypt user password due to invalid ciphertext

 

JWhitesPro_1928's avatar
JWhitesPro_1928
Icon for Cirrostratus rankCirrostratus
Jan 26, 2016
I have a ticket in with F5. I will update here when they respond in case anyone else runs into this.