From 451d0886972e71d8eeaea8eec5462dc721737fdd Mon Sep 17 00:00:00 2001
From: youpaishidifu <1@ypshidifu.cn>
Date: Thu, 1 Oct 2026 10:46:34 +0800
Subject: [PATCH] =?UTF-8?q?fix:=202FA=E4=BA=8C=E7=BB=B4=E7=A0=81token?=
 =?UTF-8?q?=E5=9B=9E=E9=80=80=E4=B8=BA=E8=A3=B8hex64=EF=BC=8C=E8=A7=84?=
 =?UTF-8?q?=E9=81=BF=E7=BA=BF=E4=B8=8AWAF=E6=8B=A6=E6=88=AA=EF=BC=88v1=5F?=
 =?UTF-8?q?=E5=89=8D=E7=BC=80=E4=B8=8Et=3D=E9=95=BFhex=E5=9D=87=E8=A2=ABCF?=
 =?UTF-8?q?=E5=B1=82404=EF=BC=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/main/java/Sdf1_login/TwoFactorManager.java | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/main/java/Sdf1_login/TwoFactorManager.java b/src/main/java/Sdf1_login/TwoFactorManager.java
index a0d4794..ec21634 100644
--- a/src/main/java/Sdf1_login/TwoFactorManager.java
+++ b/src/main/java/Sdf1_login/TwoFactorManager.java
@@ -113,8 +113,8 @@ public class TwoFactorManager {
                 System.currentTimeMillis());
 
         // 一次性随机 token：玩家凭它读取二维码载荷（10 分钟有效）
-        // v1_ 前缀：线上WAF会拦「t=纯32+位hex」形态，前缀破坏纯hex特征（已实测通过）
-        String token = "v1_" + hex(randomBytes(32));
+        // token=裸hex64 已实测可过线上WAF（t=长hex / token=v1_前缀 两种形态均被拦）
+        String token = hex(randomBytes(32));
         String uri = otpauthUri(p.getName(), secret);
 
         // pending 已落库，玩家立即可 /2fa code；二维码链接异步推送后补发