How Atlassian implemented its own multi-factor authentication library with time-based one-time passwords MFA with TOTP library

This post details the technical challenges encountered with existing TOTP libraries, including integer overflow issues leading to incorrect TOTP generation past the year 2038 and the inability to accommodate clock drifts and network delays by not supporting multiple time windows. It highlights the 'magic number' anti-pattern in a previous library that restricted it to SHA1. The post introduces Atlassian's '1time' library, emphasizing its strict adherence to RFC standards, its use of property-based testing, its ability to generate explicit QR codes with all parameters, and its implementation of a configurable time window (defaulting to one past, one current, and one future window) to mitigate verification issues.