Fix Yubikey OTP being case sensitive

Author: RaynFoxDragon

app/Http/Controllers/Profile/Settings/TwoFactor/YubikeySetupController.php

@@ -40,10 +40,14 @@ public function store(YubikeyStoreRequest $request)
         }
         RateLimiter::hit($limitKey, 120);
         $yubico = new YubicoService();
-        $yubico->verify($request->input('code'));
+        $otp = strtolower($request->input('code'));
+        $yubico->verify($otp);
 
         // Check if the Yubikey is already registered
-        if ($request->user()->twoFactors()->where('identifier', $yubico->identifier)->exists()) {
+        $already_exists = $request->user()->twoFactors()
+            ->whereRaw('LOWER(identifier) = ?', [$yubico->identifier])
+            ->exists();
+        if ($already_exists) {
             throw ValidationException::withMessages(['code' => 'This Yubikey is already registered.']);
         }
         // Create the Yubikey

app/Http/Controllers/TwoFactorController.php

@@ -74,9 +74,9 @@ public function submit(Request $request)
     public function verifyYubikey($data, Collection $twoFactors, $user): bool
     {
         // Get the first 12 characters of the code
-        $identifier = substr($data['code'], 0, 12);
+        $identifier = strtolower(substr($data['code'], 0, 12));
         // Find the identifier in $collection
-        $twoFactor = $twoFactors->firstWhere('identifier', $identifier);
+        $twoFactor = $twoFactors->firstWhere(fn($factor) => strtolower($factor->identifier) === $identifier);
         if ($twoFactor === null) {
             throw ValidationException::withMessages(['code' => 'This Yubikey is not known.']);
         }

app/Services/YubicoService.php

@@ -13,6 +13,7 @@ class YubicoService
 
     public function verify(string $otp): bool
     {
+        $otp = strtolower($otp);
         $this->nonce = bin2hex(random_bytes(16));
 
         $requestParams = [
@@ -48,7 +49,7 @@ public function verify(string $otp): bool
             throw ValidationException::withMessages(['code' => $errorMessage]);
         }
         // Get the first 12 characters of the OTP
-        $this->identifier = substr($responseData['otp'], 0, 12);
+        $this->identifier = strtolower(substr($responseData['otp'], 0, 12));
 
         return true;
     }