Class OtpBypassSettings

Namespace

SEBT.Portal.Core.AppSettings

Assembly

SEBT.Portal.Core.dll

Settings related to bypassing OTP validation for a specific email address in non-production environments. This is intended to facilitate SEBT's DAST scanning, but should be used with caution and should never be enabled in production or for any real user accounts.

public static class OtpBypassSettings

Inheritance

object

OtpBypassSettings

Fields

Email

Email address for which OTP validation will be bypassed when criteria are met. Intended for use by SEBT's DAST scanner in staging only.

public static readonly string Email

Field Value

string

FeatureFlagName

Feature flag name to enable OTP bypass. When enabled, requests that meet the bypass criteria will skip OTP validation. This should only be enabled in non-production environments and should never be enabled in production. The bypass criteria are:

1. The feature flag named by FeatureFlagName is enabled
2. The application is running in a non-production environment
3. The email in the request matches Email
4. The OTP code in the request matches OtpCode When all criteria are met, OTP validation will be bypassed, allowing testing of the login flow without needing to receive an OTP. This is intended to facilitate SEBT's DAST scanning, but should be used with caution and should never be enabled in production or for any real user accounts.

public static readonly string FeatureFlagName

Field Value

string

OtpCode

Fixed, well-known OTP code used by the DAST scanner to bypass validation. The value is intentionally predictable; safety is provided by the gating criteria (feature flag + non-production environment + scanner-specific email).

public static readonly string OtpCode

Field Value

string