This question is about OTP codes that are used in flows like
- Email verification
- SMS 2fa
Usually, when you send an OTP, you want to give the user an option to resend the OTP.
Assuming the following protections are in place:
- Limit the number of attempts to enter the right code (defend against brute force)
- Limit the number of attempts to resend the code in a certain time window (defend against spamming the recipient)
- Code has short expiration
Is there a reason to generate new OTP code on each resend attempt? If so, is it really needed to revoke the previous codes once a resend has been made?
I have seen services, Facebook for example, who send you the same code in the resend attempts. In terms of usability, it's better to send the same code so that if the first code did arrive late the user will not be confused about which code they should enter. But I am not sure if there are any practical security implications of that.