This question is about OTP codes that are used in flows like
- Email verification
- SMS 2fa
Usually, when you send an OTP, you want to give the user an option to resend the OTP.
Assuming the following protections are in place:
- Don't let the user enter wrong code more than X times (defend against brute force)
- Don't let the user do too many resend attempts in a specific time window (defend against spamming the recipient)
Is there a reason to generate new OTP code on each resend attempt ? If so, is it really needed to revoke the previous codes once a resend has been made ?
I have seen services, Facebook for example, who send you the same code in the resend attempts. In terms of usability, it's better to send the same code so that if the first code did arrive late the user will not be confused about which code they should enter. But I am not sure if there are any practical security implications of that.