Security

This page describes the security properties of the login code: lifetime and single use, the encryption of stored secrets, the protection against account disclosure, the rate limits, and the error log.

The login code

• Six digits: every login code consists of 6 digits.
• Single use: after a successful check the code is deleted immediately – the same code cannot be used a second time.
• Limited lifetime: a code expires after the configured login code lifetime – default 300 seconds (5 minutes), adjustable per sales channel. Expired codes are rejected on verification.
• One active code per recipient: at most one valid code exists per email address or mobile number and sales channel.

Encryption

The secrets from which login codes are generated and verified are stored encrypted in the database: AES-256, keyed with the APP_SECRET of the Shopware installation. Codes are never stored in plain text.

No account disclosure

The login form cannot be used to find out whether a customer account exists for an email address. When a code is requested by email, the shop always answers with the same message: "You'll receive a login code by email shortly if your email is registered." If the address is not registered, simply no email is sent – without an error message.

Rate limits

The Rate Limiter card in the settings contains three limits:

• Login code requests: at most 3 per minute (default, adjustable).
• Login attempts: at most 3 per minute (default, adjustable).
• Resend: the "Resend code" button in the form only becomes available again after 20 seconds (default).

Counting is per combination of recipient and IP address – a throttled attacker does not block the real customer behind a different IP. Anyone exceeding a limit sees the wait time: "Too many login code requests. Please wait … seconds before trying again." A successful login resets the counters; after one hour at the latest they expire on their own.

Country allowlist

Which country codes are allowed for the login by mobile number is set in the option "Allow login via mobile number". The list is enforced server-side on every request – when the code is sent and at login, not just in the input field. Numbers from other countries receive the message "Mobile numbers from your selected country are not allowed."

Error log

The extension writes errors to its own log channel cwk_quick_auth: the file var/log/cwk_quick_auth_<environment>.log (e.g. cwk_quick_auth_prod.log). The log rotates and records only errors and more severe events. Failed SMS deliveries and errors while linking mobile numbers are among the entries in that log.