Multi-Factor Authentication: Backup Code Generation

Introduction

Welcome back! In the previous lesson, we laid the groundwork for understanding Multi-Factor Authentication (MFA) and its role in enhancing security. Today, we'll focus on a critical component of MFA: backup codes . These codes act as a safety net when primary authentication methods are unavailable. By the end of this lesson, you'll learn how to generate secure backup codes, understand potential vulnerabilities, and implement them securely in a Spring Boot application. Let's get started! 🚀

Understanding Backup Codes

Backup codes are a set of one-time-use codes that serve as an alternative authentication method when users cannot access their primary MFA device. Imagine losing your phone or being in a location with no internet access; backup codes ensure you can still access your account. They help maintain access while minimizing — but not eliminating — security trade-offs, as backup codes are static and can be copied if not properly protected.

Generating Secure Backup Codes

To generate secure backup codes, we must follow best practices to ensure they are both unique and random. This involves creating codes that are difficult to guess and limiting their usage to prevent unauthorized access. Java public static List<String> generateBackupCodes(int count) {if (count <= 0) {return new ArrayList<>();} Set<String> codes = new HashSet<>(); SecureRandom random = new SecureRandom(); while (codes.size() < count) {// Generate 8-character alphanumeric code StringBuilder code = new StringBuilder(); String chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"; for (int j = 0; j < 8; j++) {code.append(chars.charAt(random.nextInt(chars.length())));} codes.add(code.toString());} return new ArrayList<>(codes);} public static List<String> generateBackupCodes(int count) {if (count <= 0) {return new ArrayList<>();} Set<String> codes = new HashSet<>(); SecureRandom random = new SecureRandom(); while (codes.size() < count) {// Generate 8-character alphanumeric code StringBuilder code = new StringBuilder(); String chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"; for (int j = 0; j < 8; j++) {code.append(chars.charAt(random.nextInt(chars.length())));} codes.add(code.toString());} return new ArrayList<>(codes);} In this code snippet, we define a method to generate a specified number of backup codes. We use a Set to ensure each code is unique. The SecureRandom class generates cryptographically strong random strings, which are then converted to uppercase for consistency. The method returns a list of these unique codes. Now, let's implement backup code generation in a Spring Boot application. We'll walk through the process step by step.

Join the 1M+ learners on CodeSignal

Be a part of our community of 1M+ users who develop and demonstrate their skills on CodeSignal

Java

public static List<String> generateBackupCodes(int count) {
    if (count <= 0) {
        return new ArrayList<>();
    }
    
    Set<String> codes = new HashSet<>();
    SecureRandom random = new SecureRandom();
    
    while (codes.size() < count) {
        // Generate 8-character alphanumeric code
        StringBuilder code = new StringBuilder();
        String chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
        
        for (int j = 0; j < 8; j++) {
            code.append(chars.charAt(random.nextInt(chars.length())));
        }
        
        codes.add(code.toString());
    }
    
    return new ArrayList<>(codes);
}

Java

@PostMapping("/setup")
public ResponseEntity<?> setup(@RequestBody Map<String, String> request) {
    String username = request.get("username");
    if (username == null || username.isEmpty()) {
        return error(HttpStatus.BAD_REQUEST, "Username is required");
    }
    // Proceed with MFA setup
}

Java

Map<String, String> secretData = MFABasics.generateSecret(username);
String secret = secretData.get("secret");
String otpauth = secretData.get("otpauth");

Java

String qrCodeUrl = generateQRCodeDataURL(otpauth);

Java

List<String> backupCodes = MFABasics.generateBackupCodes(10);

Java

userSecrets.put(username, secret);
userBackupCodes.put(username, new HashSet<>(backupCodes));

Java

Map<String, Object> response = new HashMap<>();
response.put("qrCodeUrl", qrCodeUrl);
response.put("backupCodes", backupCodes);

return ResponseEntity.ok(response);

Java

@PostMapping("/regenerate-backup-codes")
public ResponseEntity<?> regenerateBackupCodes(
        @RequestHeader(value = "Authorization", required = false) String authHeader) {
    // Verify authentication
    String username = getUsernameFromToken(authHeader);
    if (username == null) {
        return error(HttpStatus.UNAUTHORIZED, "Unauthorized");
    }
    
    User user = userRepository.findByUsername(username).orElse(null);
    if (user == null) {
        return error(HttpStatus.NOT_FOUND, "User not found");
    }
    
    // Generate new backup codes
    List<String> newBackupCodes = MFABasics.generateBackupCodes(10);
    // Hash and store the new codes (as covered in Unit 3)
    String hashedCodes = hashBackupCodes(newBackupCodes);
    user.setBackupCodes(hashedCodes);
    userRepository.save(user);
    
    return ResponseEntity.ok(Map.of("backupCodes", newBackupCodes));
}

Java

public static boolean verifyCode(String token, String secret, Set<String> backupCodes) {
    // First, try to verify the TOTP token
    if (verifyToken(token, secret)) {
        return true;
    }
    
    // If TOTP verification fails, check backup codes
    if (backupCodes.contains(token)) {
        // Invalidate the used backup code
        backupCodes.remove(token);
        return true;
    }
    
    // If neither verification succeeds, return false
    return false;
}

Introduction

Understanding Backup Codes

Generating Secure Backup Codes

Join the 1M+ learners on CodeSignal

Step 1: Define a Route to Set Up MFA

Step 2: Generate Secret and Auth URL

Step 3: Generate QR Code

Step 4: Generate Backup Codes

Step 5: Store the Secret and Backup Codes

Step 6: Return the QR Code URL and Backup Codes

What Happens When All Backup Codes Are Used or Expired?

Securing and Validating Backup Codes

Conclusion and Next Steps