Multi-Factor Authentication Foundations

Introduction

Welcome to the very first lesson of the "Multi-Factor Authentication (MFA) in FastAPI" course! In this lesson, we will explore the concept of Multi-Factor Authentication (MFA), a crucial security measure that enhances the protection of user accounts. Authentication is the process of verifying the identity of a user, and MFA adds an extra layer of security by requiring multiple forms of verification. This lesson will guide you through understanding MFA, its implementation in FastAPI, and its significance in safeguarding applications. Let's dive in!

Understanding Multi-Factor Authentication

Multi-Factor Authentication (MFA) is a security mechanism that requires users to provide two or more verification factors to gain access to a resource, such as an application or online account. The three main types of factors used in MFA are: Knowledge Factors : Something you know, like a password or PIN. Possession Factors : Something you have, such as a smartphone or security token. Inherence Factors : Something you are, like a fingerprint or facial recognition. By combining these factors, MFA significantly reduces the risk of unauthorized access, as an attacker would need to compromise multiple elements to breach an account.

How MFA Works

In real-world applications, Time-based One-Time Passwords (TOTP) are a common and secure way to implement MFA. Here's how the validation process typically works using TOTP: User Login Attempt : The user enters their username and password (knowledge factor) on the login page. MFA Challenge (TOTP) : After the password is verified, the system prompts the user to enter a 6-digit code from their authenticator app (such as Google Authenticator or Authy) on their smartphone (possession factor). Validation of the TOTP Code : When the user first sets up MFA, the server generates a unique secret key for the user and shares it with them (usually via a QR code). The user scans the QR code with their authenticator app, which stores the secret key. The authenticator app uses the secret key and the current time to generate a new 6-digit code every 30 seconds. When the user logs in and enters the code, the server uses the same secret key and the current time to independently generate the expected TOTP code. The server compares the code entered by the user with its own generated code. If they match (and are within the allowed time window), the code is valid. Access Granted or Denied : If the TOTP code is valid, the user is granted access. If the code is incorrect or expired, access is denied. This process ensures that even if an attacker knows the user's password, they cannot log in without also having access to the user's authenticator app, which securely stores the TOTP secret. The server always performs the final validation by generating and comparing the expected TOTP code.

Join the 1M+ learners on CodeSignal

Be a part of our community of 1M+ users who develop and demonstrate their skills on CodeSignal

Generating a Secret

To set up MFA, we first need to generate a secret key for the user. This secret is generated once per user and remains constant - it doesn't change with each login or verification attempt. The secret is shared between the server and the client (authenticator app), and both sides must have the same secret to generate and verify TOTP codes.

Python

import pyotp

class MFABasics:
    issuer = "YourCompany"

    @staticmethod
    def generate_secret(username: str):
        # Generate a unique, persistent secret for this specific user
        # This secret should be generated only once during MFA setup
        # and stored securely in the database for future verifications
        secret = pyotp.random_base32()
        totp = pyotp.TOTP(secret)
        otpauth = totp.provisioning_uri(
            name=username,
            issuer_name=MFABasics.issuer
        )
        return {"secret": secret, "otpauth": otpauth}

import pyotp

class MFABasics:
    issuer = "YourCompany"

    @staticmethod
    def generate_secret(username: str):
        # Generate a unique, persistent secret for this specific user
        # This secret should be generated only once during MFA setup
        # and stored securely in the database for future verifications
        secret = pyotp.random_base32()
        totp = pyotp.TOTP(secret)
        otpauth = totp.provisioning_uri(
            name=username,
            issuer_name=MFABasics.issuer
        )
        return {"secret": secret, "otpauth": otpauth}

In this code, we use the pyotp library to generate a secret key. The generate_secret method creates a random secret and constructs an OTP authentication URL, which can be used to generate a QR code for the user. Importantly, the server stores this secret securely in the database associated with that specific user, and the user's authenticator app receives it (typically by scanning the QR code). This secret remains unchanged for that user until they reset their MFA. With this shared secret, the authenticator app can generate TOTP codes, and the server can independently verify them using the same secret.

Introduction

Understanding Multi-Factor Authentication

How MFA Works

Join the 1M+ learners on CodeSignal

Exploiting the Vulnerability

Generating a Secret

Verifying the TOTP Token

Testing TOTP Verification

Real-World Examples of MFA

Conclusion and Next Steps