Multi-Factor Authentication Foundations

Introduction

Welcome to the very first lesson of the "Multi-Factor Authentication (MFA) in Express" course! In this lesson, we will explore the concept of Multi-Factor Authentication (MFA), a crucial security measure that enhances the protection of user accounts. Authentication is the process of verifying the identity of a user, and MFA adds an extra layer of security by requiring multiple forms of verification. This lesson will guide you through understanding MFA, its implementation in Express, and its significance in safeguarding applications. Let's dive in! 🔍

Understanding Multi-Factor Authentication

Multi-Factor Authentication (MFA) is a security mechanism that requires users to provide two or more verification factors to gain access to a resource, such as an application or online account. The three main types of factors used in MFA are: Knowledge Factors : Something you know, like a password or PIN. Possession Factors : Something you have, such as a smartphone or security token. Inherence Factors : Something you are, like a fingerprint or facial recognition. By combining these factors, MFA significantly reduces the risk of unauthorized access, as an attacker would need to compromise multiple elements to breach an account.

How MFA Works

In real-world applications, Time-based One-Time Passwords (TOTP) are a common and secure way to implement MFA. Here’s how the validation process typically works using TOTP: User Login Attempt : The user enters their username and password (knowledge factor) on the login page. MFA Challenge (TOTP) : After the password is verified, the system prompts the user to enter a 6-digit code from their authenticator app (such as Google Authenticator or Authy) on their smartphone (possession factor). Validation of the TOTP Code : When the user first sets up MFA, the server generates a unique secret key for the user and shares it with them (usually via a QR code). The user scans the QR code with their authenticator app, which stores the secret key. The authenticator app uses the secret key and the current time to generate a new 6-digit code every 30 seconds. When the user logs in and enters the code, the server uses the same secret key and the current time to independently generate the expected TOTP code. The server compares the code entered by the user with its own generated code. If they match (and are within the allowed time window), the code is valid. Access Granted or Denied : If the TOTP code is valid, the user is granted access. If the code is incorrect or expired, access is denied. This process ensures that even if an attacker knows the user’s password, they cannot log in without also having access to the user’s authenticator app, which securely stores the TOTP secret. The server always performs the final validation by generating and comparing the expected TOTP code.

Join the 1M+ learners on CodeSignal

Be a part of our community of 1M+ users who develop and demonstrate their skills on CodeSignal

TypeScript

import { authenticator } from 'otplib';

class MFABasics {
  private static readonly issuer: string = 'YourCompany';

  static generateSecret(username: string) {
    const secret = authenticator.generateSecret();
    const otpauth = authenticator.keyuri(username, this.issuer, secret);
    return { secret, otpauth };
  }
}

import { authenticator } from 'otplib';

class MFABasics {
  private static readonly issuer: string = 'YourCompany';

  static generateSecret(username: string) {
    const secret = authenticator.generateSecret();
    const otpauth = authenticator.keyuri(username, this.issuer, secret);
    return { secret, otpauth };
  }
}

TypeScript

static verifyToken(token: string, secret: string): boolean {
  return authenticator.verify({ token, secret });
}

static verifyToken(token: string, secret: string): boolean {
  return authenticator.verify({ token, secret });
}

TypeScript

// Generate a TOTP code for testing (simulates authenticator app)
const testToken = authenticator.generate(secret);

// Now you can use this testToken to verify your logic
const isValid = MFABasics.verifyToken(testToken, secret);
console.log(isValid); // Should print 'true' if everything is set up correctly

// Generate a TOTP code for testing (simulates authenticator app)
const testToken = authenticator.generate(secret);

// Now you can use this testToken to verify your logic
const isValid = MFABasics.verifyToken(testToken, secret);
console.log(isValid); // Should print 'true' if everything is set up correctly

TypeScript

import { authenticator } from 'otplib';

class MFABasics {
  private static readonly issuer: string = 'YourCompany';

  static generateSecret(username: string) {
    const secret = authenticator.generateSecret();
    const otpauth = authenticator.keyuri(username, this.issuer, secret);
    return { secret, otpauth };
  }
}

TypeScript

static verifyToken(token: string, secret: string): boolean {
  return authenticator.verify({ token, secret });
}

TypeScript

// Generate a TOTP code for testing (simulates authenticator app)
const testToken = authenticator.generate(secret);

// Now you can use this testToken to verify your logic
const isValid = MFABasics.verifyToken(testToken, secret);
console.log(isValid); // Should print 'true' if everything is set up correctly

Introduction

Understanding Multi-Factor Authentication

How MFA Works

Join the 1M+ learners on CodeSignal

Exploiting the Vulnerability

Generating a Secret

Verifying the TOTP Token

Testing TOTP Verification

Real-World Examples of MFA

Conclusion and Next Steps