Security. The secret is made once and * kept in the session until a code from it is checked, so the modal opening * again (a wrong code) shows the same one. */ require_once dirname(__DIR__, 3) . '/libs/totp/totp.php'; if (empty($_SESSION['mfa_token'])) { $_SESSION['mfa_token'] = generateTotpSecret(); } $mfa_secret = $_SESSION['mfa_token']; ?>