Forum Discussion
JWhitesPro_1928
Cirrostratus
CirrostratusOTP can be bypassed by refreshing on the OTP prompt page..
Has anyone ran into this issue?
On 11.6HF6
If you're at a step in your access policy of prompting for a OTP and the user just refreshes the browser, it bypasses everything else in the polic...
Seth_Cooper
Employee
EmployeeI believe I see the issue... in the SMS Macro you have a variable assign that sets session.logon.last.password to session.user.opt.pw so when you get to the logon page "Prompt for Password" the value is set, hitting refresh will make the logic run and since the password session var has the otp in it then you will pass. If you remove the password from that variable assign do you have the same issues?