From the work in T232336: Separate recovery codes into a separate 2FA module and after the merge of https://gerrit.wikimedia.org/r/1182964, @Tgr made some suggestions for follow-up code improvements:
- src/HTMLForm/KeySessionStorageTrait.php, line 27 : use set()/getSecret() instead of set/getSessionData()
- src/Key/EncryptionHelper.php, line 105 : Instead of reusing the nonce, use random_nonce, random_nonce + 1, ... for the keys (that assumes key order is preserved, so e.g. no PHP -> JSON -> JS -> JSON -> PHP roundtrip) as the nonce doesn't have to be particularly random, just not reused. Or, preferably, just concatenate all recovery codes and encrypt as a single message.
- src/Key/RecoveryCodeKeys.php, line 166 : use RequestContext::getMain()->getRequest()->getSecurityLogContext( $user->getUser() ) instead of manual IP logging.