Ravi Sir's Cards › AWS
Hash and expire OTPs
What is a VPC: your own private network inside one AWS Region, example ThreeTierVpc 10.0.0.0/16.
Read card text
What this card says
Why do we need it?
A DynamoDB leak of raw OTPs lets attackers log in. Forever-valid codes are worse.
What is it?
Store only a hash (e.g. sha256 of dest + otp). Store expiresAt as Unix epoch seconds. Reject after expiry.
How to do it
Generate secrets.token_hex / random 6 digits → hashlib.sha256 → PutItem → never log the raw otp.
expiresAt=now+300
Example
After 5 minutes verify returns false even with the correct old digits.