V8-archive: 2FA - Two Factor Authentication Support

[vzool]

Hi,

I'm looking forward to secure this wonderful middleware system with 2FA - Two Factor Authentication at both levels API and Web if enabled.

Thanks

[rijkvanzanten]

In terms of input, this would mean that logging in requires a 6 char code (One Time Password OTP) generated by an authenticator application.

{
  "email": "[email protected]",
  "password": "password",
  "otp": "123456"
}

[benhaynes]

Would we generate/manage this ourselves (over email), or use some library/service (potentially adds SMS too)?

Does anyone have any thoughts or recommendations?

[vzool]

In terms of input, this would mean that logging in requires a 6 char code (One Time Password OTP) generated by an authenticator application.

{
  "email": "[email protected]",
  "password": "password",
  "otp": "123456"
}

Yes, 6 chars is enough for now and this could work. 🙂
But, I prefer to split this into two requests not one. Like this:

• First request:

{
  "email": "[email protected]",
  "password": "password"
}

• First response:

{
  "challenge": "57eabcc4-dce0-427b-bfb0-f99b56c849df",
  "type": "otp",
  "hint": "null" # otp is null
  # "hint": "public-key" # for U2F
  # "hint": "+9xxxxxxxxxxxxx786" # for SMS
  # "hint": "[email protected]" # for Email
}

• Second request:

{
   "challenge": "57eabcc4-dce0-427b-bfb0-f99b56c849df",
   "code": "123456"
}

After that the challenge should be delated and combined with expiration date.
This design will help us in the future to add more options like SMS, Email and U2F. 🤓

[vzool]

Would we generate/manage this ourselves (over email), or use some library/service (potentially adds SMS too)?

Does anyone have any thoughts or recommendations?

Yes, I did. 😍
No need for any services I just use this simple and nice one file library PHPGangsta/GoogleAuthenticator which is using OTP only. 🤓

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[benhaynes]

To achieve better clarity/visibility, we are now tracking feature requests within the Feature Request project board.

This issue being closed does not mean it's not being considered.

[OscBacon]

Hi,
I am currently working on implementing 2FA for login. Any pointers / specific parts of the documentation I should look at?

[benhaynes]

Hey @OscBacon — that would be awesome!! 😄

@bjgajjar @hemratna — any pointers on where this should exist within the code?

[OscBacon]

@benhaynes Thanks!
I am wondering too, could this be possible as an extension, similar to how SSO seems to be explained in the docs?

[benhaynes]

Not sure, but @bjgajjar should be able to help you here or on our Slack. :)