OWASP Jotp

Thank you for visiting OWASP.org. We recently migrated our community to a new web platform and regretably the content for this page needed to be programmatically ported from its previous wiki page. There’s still some work to be done. The historical content can be found here.

Please visit our Page Migration Guide for more information about updating pages for the new website as well as examples of github markdown.

Main

![OWASP_Project_Header.jpg](OWASP_Project_Header.jpg "OWASP_Project_Header.jpg")

OWASP jOTP is a microservice implemented in Java that can be used to generate, validate, and automatically expire one-time use password tokens.

Description

A common use case for jOTP is as follows: 1. Client applications displays a login page requesting the user enter his/her username and password. 2. If the credentials check passes, the user's email is looked up and a message containing the token is sent. 3. The application then requests that the OTP token that was sent be entered in a text box. Once entered, it is sent to jOTP. 4. jOTP validates the token. If the token was valid, the application finishes authenticating the user. If the token was not valid, the user is redirected to the login page.

Licensing

OWASP jOTP is available under the BSD 2-Clause License.

</td>

Rob Upcraft

</td>

Email List

OWASP jOTP Mailing List NOTE: Include "jOTP" in the subject heading of all emails to this list.

News and Events

</td>

What is jOTP?

OWASP jOTP provides:

OWASP jOTP provides:

    • OTP token generation, validation, and expiration.
    • OTP token generation, validation, and expiration.

Project Leader

Project Leader

Rob Upcraft

FAQs

  • Where can OWASP jOTP be downloaded? The source code, along with basic documentation, is located here: GitHub Repository
  • I can see the /sys/monitor endpoint, but when I try to test the other endpoints (eg. /otp/validate), I don’t get anything in the response. The endpoints under /otp only respond to POST requests, and will return an empty response if they are requested via GET.

Acknowledgements

Volunteers

OWASP jOTP is developed by a worldwide team of volunteers. The primary contributors to date have been:

  • Rob Upcraft

Road Map and Getting Involved

As of April 2014, the priorities are:

Development work for jOTP is largely complete as of now. Because it is intended to be lightweight and focused on this use case, the feature set is not planned to grow significantly, if at all. Most future work will include bug fixes, and additional customization options developed on an as-needed basis.

Involvement in the development and promotion of OWASP jOTP is actively encouraged! You do not have to be a security expert in order to contribute.

Some of the ways you can help:

  • Submit issues to the GitHub repository.
  • Submit pull requests for fixes to the GitHub repository.

NOTOC

Category:OWASP Project

Example

Put whatever you like here: news, screenshots, features, supporters, or remove this file and don’t use tabs at all.

Watch Star