Two-factor authentication (2FA), also known as multi-factor authentication (MFA), is a security mechanism that requires users to provide two or more separate forms of identification to verify their identity and gain access to a system or account. It adds an extra layer of security beyond traditional username and password authentication.

The two factors typically fall into three categories:

Something you know: This factor involves knowledge-based information that the user possesses, such as a password, PIN, or answers to security questions.

Here's a simplified example of how two-factor authentication works:

Two-factor authentication is widely used across various systems, including online accounts (email, social media, banking), VPNs, cloud services, and more. It significantly reduces the risk of unauthorized access due to compromised passwords or stolen credentials, enhancing overall security and protecting sensitive information.

Speakeasy is a one-time passcode generator, ideal for use in two-factor authentication, that supports Google Authenticator and other two-factor devices.

It is well-tested and includes robust support for custom token lengths, authentication windows, hash algorithms like SHA256 and SHA512, and other features, and includes helpers like a secret key generator.

Speakeasy implements one-time passcode generators as standardized by the Initiative for Open Authentication (OATH). The HMAC-Based One-Time Password (HOTP) algorithm defined in RFC 4226 and the Time-Based One-time Password (TOTP) algorithm defined in RFC 6238 are supported. This project incorporates code from passcode, originally a fork of Speakeasy, and notp.

// user.entity.ts
@Column({ nullable: true, type: 'text' })
twoFASecret: string;


@Column({ default: false, type: 'boolean' })
enable2FA: boolean;

You have to add two new columns for two-factor authentication. The first column will be used to store the secret key for each user. The second column will be used to enable or disable the two-factor authentication.

//types/auth-types.ts
export type Enable2FAType = {
  secret: string;
};

Add a new method in AuthService to enable two-factor auth

//auth.service.ts
import * as speakeasy from 'speakeasy';


async enable2FA(userId: number) : Promise<Enable2FAType> {
const user = await this.userService.findById({ id: userId }); //1
if (user.enable2FA) { //2
return { secret: user.twoFASecret };
}
const secret = speakeasy.generateSecret(); //3
console.log(secret);
user.twoFASecret = secret.base32; //4
await this.userService.updateSecretKey(user.id, user.twoFASecret); //5
return { secret: user.twoFASecret }; //6
}

---
title: Two-Factor Authentication
privateVideoUrl: https://fullstack.wistia.com/medias/egnw3hjow7
isPublicLesson: true
---

### What is Two Factor Authentication

Two-factor authentication (2FA), also known as multi-factor authentication (MFA), is a security mechanism that requires users to provide two or more separate forms of identification to verify their identity and gain access to a system or account. It adds an extra layer of security beyond traditional username and password authentication.

The two factors typically fall into three categories:

Something you know: This factor involves knowledge-based information that the user possesses, such as a password, PIN, or answers to security questions.

1.  Something you have: This factor requires the user to possess a physical device or object, such as a smartphone, hardware token, or smart card. This device generates or receives a unique one-time code or a cryptographic key.
2.  Something you are: This factor refers to biometric characteristics unique to the individual, such as fingerprints, facial recognition, iris scans, or voice recognition.
3.  The combination of these factors increases the security of authentication because an attacker would need to compromise multiple elements to gain unauthorized access. Even if one factor is compromised, the additional factor(s) provide an extra layer of protection.

Here's a simplified example of how two-factor authentication works:

1.  The user enters their username and password on a login page.
2.  After successful initial authentication, the system prompts the user for a second form of verification.
3.  The user may be required to provide a one-time code generated by an authentication app on their smartphone or received via SMS.
4.  The user enters the one-time code to complete the authentication process.
5.  If both factors are verified successfully, access is granted to the user.

Two-factor authentication is widely used across various systems, including online accounts (email, social media, banking), VPNs, cloud services, and more. It significantly reduces the risk of unauthorized access due to compromised passwords or stolen credentials, enhancing overall security and protecting sensitive information.

### Install Dependencies

Speakeasy is a one-time passcode generator, ideal for use in two-factor authentication, that supports Google Authenticator and other two-factor devices.

It is well-tested and includes robust support for custom token lengths, authentication windows, hash algorithms like SHA256 and SHA512, and other features, and includes helpers like a secret key generator.

Speakeasy implements one-time passcode generators as standardized by the Initiative for Open Authentication (OATH). The HMAC-Based One-Time Password (HOTP) algorithm defined in RFC 4226 and the Time-Based One-time Password (TOTP) algorithm defined in RFC 6238 are supported. This project incorporates code from passcode, originally a fork of Speakeasy, and notp.

```ts
"speakeasy": "^2.0.0",
```

You have to add this entry to `dependencies` in the package.json file and run `npm install`

```ts
"@types/speakeasy": "^2.0.7",
```

You have to add this entry to `devDependencies` in the package.json file and run `npm install`

### Update User Entity

```ts
// user.entity.ts
@Column({ nullable: true, type: 'text' })
twoFASecret: string;


@Column({ default: false, type: 'boolean' })
enable2FA: boolean;
```

You have to add two new columns for two-factor authentication. The first column will be used to store the secret key for each user. The second column will be used to enable or disable the two-factor authentication.

### Add new Enable2FA type

```ts
//types/auth-types.ts
export type Enable2FAType = {
  secret: string;
};
```

### Add a new method in AuthService to enable two-factor auth

```ts
//auth.service.ts
import * as speakeasy from 'speakeasy';


async enable2FA(userId: number) : Promise<Enable2FAType> {
const user = await this.userService.findById({ id: userId }); //1
if (user.enable2FA) { //2
return { secret: user.twoFASecret };
}
const secret = speakeasy.generateSecret(); //3
console.log(secret);
user.twoFASecret = secret.base32; //4
await this.userService.updateSecretKey(user.id, user.twoFASecret); //5
return { secret: user.twoFASecret }; //6
}
```

Haider Malik

Two-Factor Authentication

In this lesson, I'm going to teach you how to use or how to enable how to

You're going to learn how to implement two factor authentication.

If you don't know about two factor authentication, you can read this text.

A user enters the username and password on a login page.

After successful initial authentication, the system sends you the one time

A user may provide the one time code generated by the authenticator app and

If token has validated, then you are able to authenticate.

We're going to use third party package to implement two factor authentication.

First of all, I would like to show you the demo.

I already implemented in my development project.

First of all, you got a login to the user.

You're going to create a new endpoint to enable the authentication.

This endpoint will enable the authentication for the user and it will create a

Now I got this secret key and I got this response from the speak easy package

I saved this base 32 string to my database table for the user table.

If you have authenticator app, Google authenticator, you can place the secret

I have enabled the Google Chrome extension.

When you look at Chrome Google authenticator, you have to enable this extension

If you have Google authenticator on your phone or you can install it, all you

You can also generate the QR code with this OTP path.

You can generate QR code by using this URL.

But you can add manual entry for testing.

Now I started getting a unique one time password.

It's going to be removed after one minute.

Now I have to provide this token to validate the user.

Yes, we have to add a new token because it will be expired.

Now this user has enabled the two factor authentication.

If you send the login request, you see this message.

Hey, you have enabled two factor authentication.

You can implement this logic on your front end application.

Please send the one time password token from a Google Authenticator app.

On the front end side, you can send request to this endpoint and provide the

That's a complete flow of two factor authentication.

Let's start implementing two factor authentication.

We will use this package to generate secret key or validate the token one time

The first step, you have to add two new columns inside the user entity.

By default, two factor string should pin now.

By default, I have set to default to false.

When you run the application, it should create two new columns for the user

I have the two FAC credit in enable to FAA, which is a Boolean column.

Now we're going to create a new method inside the auth service to enable the

Learn

The newline Guide to Building Your First GraphQL Server with Node and TypeScript

Teach

Amelia Wattenberger

Author of Fullstack D3

Community

Masterclasses

Tutorials

Fullstack React with TypeScript