Multi-Factor Authentication

Prerequisites: completed Session-Based Auth Fundamentals, an authenticator app (Google Authenticator, 1Password, Authy) for testing, a browser/device that supports WebAuthn.

Version note: verified against current npm documentation as of July 2026. otplib is at major version 13, which restructured the library around a single unified TOTP API — the older, separate 'authenticator' package's functionality is now folded directly into otplib's core, so treat any tutorial importing a standalone authenticator package as referencing an outdated version. Passkeys/WebAuthn are implemented with @simplewebauthn/server and @simplewebauthn/browser, the de facto standard pairing for this in the Node.js ecosystem. SMS-based one-time codes are deliberately not covered as a primary method in this project — both otplib's own guidance and current OWASP MFA guidance treat SMS OTP as vulnerable to SIM-swapping and SS7-level interception, appropriate only as a low-security fallback, not a primary factor.

"Multi-factor" specifically means combining factors from different categories — something you know (a password), something you have (a phone running an authenticator app, or a hardware key), or something you are (biometrics, gated through a platform authenticator). A password plus a second password isn't MFA; a password plus a time-based code from a separate device is. This project adds TOTP as the baseline second factor, backup codes as the account-recovery path every MFA system needs, and WebAuthn/passkeys as the strongest and most user-friendly option to steer users toward over time.