Module - Authorization via SMS «OTP»

The "SMS Authorization «OTP»" module allows you to configure secure and convenient customer authorization by SMS, setting parameters for generating, validating, and blocking one-time passwords that help reduce the risk of spam and abuse of OTP requests.

The module settings contain three tabs: "Settings", "OTP Logs", and "IP Logs".

The "Settings" tab contains the following options:

1. Status — a switch for activating or deactivating the module.

   • ON: the module is active, SMS OTP «One Time Password» authorization works.
   • OFF: the module is inactive, standard e-mail authorization is used.

2. OTP length — the number of digits in the one-time password «OTP» sent to the customer.

   • The code length can be from 4 to 10 digits.

3. OTP validity period «Minutes» — the time during which the OTP is valid.

   • Specified in minutes. After this time expires, the code becomes invalid, and the customer will need to request a new code.

4. Maximum number of attempts — the maximum number of incorrect OTP entries before blocking.

   • After this number of failed attempts is exceeded, the user or phone number will be temporarily blocked.

5. Blocking time «Minutes» — the user blocking period after the maximum number of attempts is exceeded.

   • Specified in minutes. During this time, the user will not be able to request OTP again.

6. Time between requests «Seconds» — the minimum time in seconds between OTP requests.

   • This restriction prevents spam requests for codes.

7. Phone mask — the phone number display format that makes it easier for the customer to enter the number.

   • For example, the format +38 «999» 999-99-99 helps customers enter the number in a standardized format.

8. Enable logging — a switch for recording OTP attempts in the log.

   • ON: all OTP attempts are recorded in the log.
   • OFF: OTP attempts are not recorded.

---

The "OTP Logs" tab is intended for tracking all attempts to enter one-time passwords «OTP» by users. The following settings are available:

1. Delete logs — a button for clearing the log journal. Clicking this button will delete all records of OTP entry attempts.

2. OTP attempt list — a table with information about all OTP entry attempts. Table columns:

   • Customer ID — the customer name and e-mail address. This helps identify the user who made the attempt.
   • Phone — the customer's phone number to which the OTP was sent.
   • Status — the OTP entry result:
     • Success «Green indicator» — the OTP entry was successful.
     • Failure «Red indicator» — the OTP entry attempt failed because the code was incorrect.
   • Date added — the date and time of the OTP entry attempt. Allows you to track the time of each attempt.

---

The "IP Logs" tab is intended for tracking attempts to request or enter one-time passwords «OTP» from different IP addresses. The table will display a list of all IP addresses with the corresponding information. This log allows administrators to monitor OTP request activity by IP address, which can be useful for detecting and preventing suspicious activity or mass OTP brute-force attempts.

Tab element description:

1. IP address — shows the IP address of the user who tried to request or enter OTP. This helps detect suspicious activity from specific IP addresses.

2. Number of attempts — displays the total number of OTP request or entry attempts from a specific IP address. This allows you to monitor the number of authorization attempts that may indicate unauthorized access attempts.

3. Last attempt — the date and time of the last OTP request or entry attempt from this IP. This helps administrators see when the last activity from this IP occurred.