> For the complete documentation index, see [llms.txt](https://docs-siticoneframework.gitbook.io/home/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs-siticoneframework.gitbook.io/home/net-framework-or-net-core-ui/input-controls/siticone-otp/security-and-input-protection.md).

# Security & Input Protection

## Overview

This feature encapsulates functionality for managing sensitive input data within the control, ensuring that confidential codes or tokens are handled securely. It includes properties for auto-clearing the entered data after a set delay and for enforcing a read-only state that prevents accidental or unauthorized modifications.

***

### Key Points

| Point                       | Description                                                                                                                                 |
| --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
| Auto-Clear                  | The control can automatically clear its input after a configurable delay, ensuring that sensitive data does not persist longer than needed. |
| Read-Only Mode              | When enabled, the control prevents any modifications to the entered code, acting as a digital display case for secure data presentation.    |
| Customization of Appearance | Developers can specify a custom overlay color (ReadonlyBackColor) to visually indicate the control’s read-only state.                       |
| Configurable Timing         | The delay before auto-clear can be configured via the AutoClearDelaySeconds property, allowing fine-tuning based on the sensitivity level.  |

***

### Best Practices

| Practice                         | Recommendation                                                                                                                                                   |
| -------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Use AutoClear for Sensitive Data | Enable AutoClearEnabled when displaying PINs or one-time codes to ensure data is not left visible on the screen.                                                 |
| Customize Delay Appropriately    | Set AutoClearDelaySeconds to a value that balances usability with security; too short a delay might frustrate users, while too long a delay could risk exposure. |
| Employ Read-Only Mode            | For scenarios where the code must be displayed but not modified, use the ReadOnly property in combination with ReadonlyBackColor for clear visual feedback.      |
| Combine with Validation          | Use input validation in conjunction with security features to prevent invalid characters from being processed, maintaining the integrity of the entered data.    |

***

### Common Pitfalls

| Pitfall                                       | Explanation                                                                                                                         | Mitigation                                                                                                                                      |
| --------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- |
| Setting an Inadequate AutoClear Delay         | A very short delay may clear the data before the user has finished reading it, while a very long delay might compromise security.   | Test different delay values in your application context to ensure that the auto-clear mechanism meets both security and usability requirements. |
| Neglecting Visual Indicators in ReadOnly Mode | Without a proper visual overlay, users may be confused about why they cannot modify the code when the control is in read-only mode. | Customize the ReadonlyBackColor property to provide an intuitive visual cue that the control is in a non-editable state.                        |
| Overriding Security Settings Unintentionally  | Developers might accidentally disable essential security properties (e.g., setting ReadOnly to false) in sensitive scenarios.       | Review your application’s security requirements and enforce default settings, particularly in areas dealing with confidential data.             |

***

### Usage Scenarios

| Scenario                                | Description                                                                                                                                         | How to Implement                                                                                                                              |
| --------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------- |
| One-Time Password (OTP) Input           | When users enter a one-time password, the control can auto-clear the input after a short delay to minimize security risks.                          | Set `AutoClearEnabled` to `true` and configure `AutoClearDelaySeconds` to an appropriate short duration (e.g., 30 seconds).                   |
| Secure Display of Verification Codes    | In applications where verification codes need to be displayed but not altered, the read-only mode secures the information while keeping it visible. | Set `ReadOnly` to `true` and adjust `ReadonlyBackColor` to provide a subtle overlay indicating the secure, non-editable state of the control. |
| Data Entry in Banking or Financial Apps | For fields that require secure code entry (e.g., ATM PINs), the security features ensure that sensitive data is automatically cleared post-entry.   | Combine both auto-clear and input validation features to enforce strict formatting and timed clearance of the entered digits.                 |

***

### Code Examples

#### Example 1: Enabling Auto-Clear for a Sensitive Input Field

```csharp
// Create an instance of the control
SiticoneOtp otpControl = new SiticoneOtp();

// Enable auto-clear and set a 30-second delay
otpControl.AutoClearEnabled = true;
otpControl.AutoClearDelaySeconds = 30;

// Optionally, subscribe to the AutoClearWarning event to notify the user before the input is cleared
otpControl.AutoClearWarning += (sender, e) =>
{
    // For instance, show a warning message in the UI or log the event
    Console.WriteLine($"Warning: Input will clear in {e.RemainingSeconds} seconds.");
};
```

#### Example 2: Configuring Read-Only Mode for Displaying a Verification Code

```csharp
// Create an instance of the control
SiticoneOtp otpControl = new SiticoneOtp();

// Set the control to read-only to prevent any modifications
otpControl.ReadOnly = true;

// Customize the visual overlay to indicate the secure mode
otpControl.ReadonlyBackColor = Color.LightGray;

// Set a sample code to be displayed (note: this will not be modifiable)
otpControl.SetValue("123456");

// Add the control to your form
this.Controls.Add(otpControl);
otpControl.Location = new Point(50, 50);
```

#### Example 3: Handling Security Events

```csharp
// Create an instance of the control
SiticoneOtp otpControl = new SiticoneOtp();

// Enable auto-clear for sensitive input
otpControl.AutoClearEnabled = true;
otpControl.AutoClearDelaySeconds = 45;

// Subscribe to the InputCompleted event to process the entered code securely
otpControl.InputCompleted += (sender, e) =>
{
    // Process the entered code (e.g., authenticate or verify)
    int codeNumber = e.EnteredCodeAsInt;
    string codeString = e.EnteredCodeAsString;
    Console.WriteLine($"Input completed: {codeString} (numeric: {codeNumber})");
};

// Subscribe to the ValidationFailed event to handle any invalid input attempts
otpControl.ValidationFailed += (sender, e) =>
{
    foreach (var invalidChar in e.InvalidCharacters)
    {
        Console.WriteLine($"Invalid character at index {invalidChar.Index}: {invalidChar.Value}");
    }
};
```

***

### Review

| Aspect                      | Evaluation                                                                                                                                               |
| --------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Flexibility                 | The feature provides granular control over security settings, allowing developers to adjust auto-clear timing and read-only modes as needed.             |
| Ease of Integration         | With simple property settings and event hooks, integrating security features into WinForms applications is straightforward.                              |
| Visual & Functional Clarity | Customizable properties like ReadonlyBackColor and AutoClearDelaySeconds ensure that both visual feedback and security functionality are clear to users. |

***

### Summary

Security & Input Protection in the SiticoneOtp control is designed to ensure that sensitive data is handled with care by automatically clearing input after a specified delay and by providing a read-only mode to prevent unauthorized modifications. By using this feature, developers can build secure and user-friendly applications that require careful management of confidential input data.

***

### Additional Recommendations

| Recommendation                              | Explanation                                                                                                                             |
| ------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- |
| Test Extensively in Real-World Scenarios    | Security features should be tested under various conditions to ensure the auto-clear mechanism and read-only mode function as intended. |
| Document Security Behavior Clearly          | Clearly document the security-related settings in your application to maintain consistency and avoid accidental misconfiguration.       |
| Combine with Comprehensive Input Validation | Use the input validation features in tandem with security settings to maintain high data integrity and user trust.                      |