19 lines
432 B
Markdown
19 lines
432 B
Markdown
# ADR 002: Store OTP State In Redis
|
|
|
|
## Status
|
|
|
|
Accepted.
|
|
|
|
## Context
|
|
|
|
OTP state is temporary, security-sensitive, and must expire automatically.
|
|
|
|
## Decision
|
|
|
|
Store only HMAC hashes of OTP codes in Redis, with TTLs, attempt counters, and request rate limits.
|
|
|
|
## Consequences
|
|
|
|
OTP verification is fast and self-expiring. Plaintext OTPs are not persisted. The local debug provider writes a separate development-only key for demos.
|
|
|