Avoid letting attribute be manually set and reset confirmation along with secret.
@@ -108,12 +108,17 @@ public class TOTPUser extends DelegatingUser {
// Create independent, mutable copy of attributes
attributes = new HashMap<>(attributes);
+ // Do not expose any TOTP secret attribute outside this extension
+ attributes.remove(TOTP_KEY_SECRET_ATTRIBUTE_NAME);
+
// Pull off the boolean reset field
String reset = attributes.remove(TOTP_KEY_SECRET_RESET_FIELD);
// If reset has been set to true, clear the secret.
- if (reset != null && reset.equals("true"))
+ if (reset != null && reset.equals("true")) {
attributes.put(TOTP_KEY_SECRET_ATTRIBUTE_NAME, null);
+ attributes.put(TOTP_KEY_CONFIRMED_ATTRIBUTE_NAME, null);
+ }
super.setAttributes(attributes);
