Skip to main content

Class: MFAStrategy

Defined in: src/auth/MFAStrategy.ts:126

Implements a multi-factory authentication (MFA) strategy that performs basic id and password verification, followed by a secondary authentication. This strategy requires an existing user account to have already registered a valid password that will be validated as well as at least one secondary authentication method.

Supported secondary authentication (2FA) methods:

  • FIDO2 - A hardware-based key challenge exchange that the user has access to (e.g. Yubikey, Passkey, etc).
  • OTP - A One Time Password (OTP) sent to one of the user's verified contacts.
  • TOTP - A Time-Based One Time Password (TOTP) configured on a device the user owns or has access to.

The login flow has three phases:

  1. Verify Basic - The client sends a request with Authorization header containing the user's id and password. The server returns with a list of available secondary authentication methods.
  2. Challenge - The client requests a selected 2FA challenge. If a TOTP 2FA method is chosen, the request is processed as phase 3. For all others, a challenge is generated and stored in the session. If OTP is selected, a notification containing the challenge token is sent to the selected verified contact.
  3. Verify - The client submits the completed 2FA challenge. The challenge is verified against the one stored in the session, and the associated user is resolved using the getUser() callback.

Implements​

  • AuthStrategy

Constructors​

Constructor​

new MFAStrategy(options): MFAStrategy

Defined in: src/auth/MFAStrategy.ts:130

Parameters​

options​

MFAStrategyOptions

Returns​

MFAStrategy

Properties​

name​

readonly name: string = "mfa"

Defined in: src/auth/MFAStrategy.ts:127

The unique name of the strategy used to register with the AuthMiddleware.

Implementation of​

AuthStrategy.name

Methods​

authenticate()​

authenticate(req, res, required?): Promise<AuthResult | undefined>

Defined in: src/auth/MFAStrategy.ts:134

Attempts to perform authentication with the given request data. If authentication was successful, returns an AuthResult containing the authentication details. If authentication fails and required is set to true throws an error, otherwise returns undefined.

Parameters​

req​

HttpRequest

The request containing data to attempt authentication with.

res​

HttpResponse

The response to use when writing back directly to the client.

required?​

boolean

Set to true to if authentication is required to pass, otherwise set to false.

Returns​

Promise<AuthResult | undefined>

Implementation of​

AuthStrategy.authenticate

authenticateSync()​

authenticateSync(req, res, required?): AuthResult | undefined

Defined in: src/auth/MFAStrategy.ts:183

Attempts to perform authentication with the given request data. If authentication was successful, returns an AuthResult containing the authentication details. If authentication fails and required is set to true throws an error, otherwise returns undefined.

This is the synchronous version of authenticate that performs blocking based authentication.

Parameters​

req​

HttpRequest

The request containing data to attempt authentication with.

res​

HttpResponse

The response to use when writing back directly to the client.

required?​

boolean

Set to true to if authentication is required to pass, otherwise set to false.

Returns​

AuthResult | undefined

Implementation of​

AuthStrategy.authenticateSync

challenge()​

protected challenge(payload, req, res): Promise<void>

Defined in: src/auth/MFAStrategy.ts:187

Parameters​

payload​

any

req​

HttpRequest

res​

HttpResponse

Returns​

Promise<void>

verifyBasic()​

protected verifyBasic(req, res): Promise<JWTUser | undefined>

Defined in: src/auth/MFAStrategy.ts:227

Parameters​

req​

HttpRequest

res​

HttpResponse

Returns​

Promise<JWTUser | undefined>

verifyFIDO()​

protected verifyFIDO(payload, req, res): Promise<JWTUser | undefined>

Defined in: src/auth/MFAStrategy.ts:254

Parameters​

payload​

any

req​

HttpRequest

res​

HttpResponse

Returns​

Promise<JWTUser | undefined>

verifyOTP()​

protected verifyOTP(payload, req, res): Promise<JWTUser | undefined>

Defined in: src/auth/MFAStrategy.ts:258

Parameters​

payload​

any

req​

HttpRequest

res​

HttpResponse

Returns​

Promise<JWTUser | undefined>

verifyTOTP()​

protected verifyTOTP(payload, req, res): Promise<JWTUser | undefined>

Defined in: src/auth/MFAStrategy.ts:265

Parameters​

payload​

any

req​

HttpRequest

res​

HttpResponse

Returns​

Promise<JWTUser | undefined>