<p>Helllo, firstly I am not an expert, so please teach me if anything goes wrong in this post and please don’t judge my english.</p>
<p>Let’s talk about the topic…</p>
<h2>How a otp system works (as per my knowlwdge)</h2>
<h3>First way</h3>
<p>First a user come to the authentication page, then he sees a form where he has to enter his email or phone number and request a otp to verify that email/phone and he recives a otp. Then he copies that otp and paste it in the box and now that email/phone is verified.</p>
<h3>Second way</h3>
<p>In this way he recives a link in his mail, and when he clicks on it the email gets verified.</p>
<h3>What happens in backend</h3>
<p>When a user requests for otp by sending his email to backend, The backend creates a random string and store it in redis cache whith a expiry life time along with its email. And when the user sends that otp, in backend that otp gets mathed with the stored one.</p>
<h2>The concept</h2>
<h3>Thought</h3>
<p>Everytime I have created this system for authentication I had a thought do I really need a database and a redish instance costs 1500 INR for a month and I think it’s a pricy for a toy project as we don’t really want OTP for any-other purpose. So I thought using a hashing kind of thing to eleminate the database completely.</p>
<h3>Approach</h3>
<p>Lets divide the OTP into 2 parts</p>
<ol>
<li>The raw OTP string</li>
<li>Hashed OTP string
The raw OTP string will be sent to the email/phone
The hashed OTP will be shared with the requested user (Browser)</li>
</ol>
<p>And in the next request user will provide the OTP from email and stored hash OTP. And, in backend we can compare them and if it matches.</p>
<p>But a user can change the hash and send it. So here comes the JSON web token we can add the hash and email to a JWT so that user can’t change the hash and we can also add a JWT expiry time for the OTP.</p>
<p>Normally a OTP is 6 digit number. So a person can create a rainbow table of all 6 digits hash and cand match it to know the OTP. To over come this we can use hmac who takes a starting key so brute force is not possibele.</p>
<pre><code class="language-JS"><span class="hljs-keyword">export</span> <span class="hljs-keyword">function</span> <span class="hljs-title function_">hashedOTP</span>(<span class="hljs-params">otp: string</span>) {
  <span class="hljs-keyword">return</span> crypto.<span class="hljs-title function_">createHmac</span>(<span class="hljs-string">&#x27;sha256&#x27;</span>, process.<span class="hljs-property">env</span>.<span class="hljs-property">CRYPTO_SECRET</span>).<span class="hljs-title function_">update</span>(otp).<span class="hljs-title function_">digest</span>(<span class="hljs-string">&#x27;hex&#x27;</span>);
}
</code></pre>
<h2>Demo</h2>
<p>For this I have created a working Demo - <a href="https://db-less-otp.netlify.app/" target="_blank" rel="noopener nofollow">https://db-less-otp.netlify.app/</a></p>
<p>Backend Github Repo - <a href="https://github.com/SBRakeshRath/DB-less-OTP-Backend" target="_blank" rel="noopener nofollow">https://github.com/SBRakeshRath/DB-less-OTP-Backend</a>
Frontend Github Repo - <a href="https://github.com/SBRakeshRath/DB-less-OTP-Frontend" target="_blank" rel="noopener nofollow">https://github.com/SBRakeshRath/DB-less-OTP-Frontend</a></p>
<p>** I am Using a gmail account so I don’t want you to spam this as you can send only 500 emails</p>
<p>Please point-out the vulnerabilities and how to fix them.</p>

You can share you thought with this squad 

Backend Developer 

The post explains how an OTP system typically works and proposes a concept for a database-less OTP system using hashing and JSON Web Tokens (JWT) to reduce costs. It suggests creating a raw OTP sent to the user and a corresponding hashed OTP shared with the user's browser. This approach can prevent database dependency while maintaining security. A demo and GitHub repositories for the backend and frontend implementations are provided.

Database less OTP- A concept

<p>Please share your opinions or any vulnerabilities  or to be wild try to hack <a href="https://db-less-otp.netlify.app/" target="_blank" rel="noopener nofollow">https://db-less-otp.netlify.app/</a></p>
