A Small Refresh Bug That Uncovered Security Gaps in My OTP System

Short summary

A frontend refresh bug in OTP verification led to a full security redesign revealing three critical gaps: no rate limiting on the verify endpoint, user-enumeration via error messages, and no protection on the generate-OTP endpoint. The author advocates moving source-of-truth to the server with token-based references, and securing both generate and verify steps equally to prevent cost attacks and resource exhaustion.

• •Refresh bug exposed that OTP state was stored in React Router memory, not server-side
• •Three security gaps found: no rate limiting, error-based user enumeration, unprotected generate endpoint
• •Generate endpoint is the easier attack target — enables cost attacks and DoS without guessing codes

Generated with AI, which can make mistakes.