Skip to main content

Class: TOTPStrategyOptions

Defined in: auth/src/auth/TOTPStrategy.ts:15

Describes the configuration options that can be used to initialize TOTPStrategy.

Constructors​

Constructor​

new TOTPStrategyOptions(): TOTPStrategyOptions

Returns​

TOTPStrategyOptions

Properties​

allowQueryParam​

allowQueryParam: boolean = false

Defined in: auth/src/auth/TOTPStrategy.ts:27

Set to true to allow credentials to be supplied via the queryKey URL parameter. Disabled by default — query parameters appear in server logs, browser history, and Referer headers, which permanently exposes credentials outside the application.

encryptionKey?​

optional encryptionKey?: string

Defined in: auth/src/auth/TOTPStrategy.ts:33

The 64-character hex encryption key (TOTPConfig.encryption_key) to decrypt a stored secret with before verifying, if secrets are encrypted at rest. Omit if secrets are stored as plaintext (the default) - see encryptTOTPSecret()/decryptTOTPSecret() in shared.ts.

headerKey​

headerKey: string = "authorization"

Defined in: auth/src/auth/TOTPStrategy.ts:17

The name of the header to look for when performing header based authentication. Default value is Authorization.

headerScheme​

headerScheme: string = "totp"

Defined in: auth/src/auth/TOTPStrategy.ts:19

The authorization scheme type when using header based authentication. Default value is jwt.

queryKey​

queryKey: string = "auth_totp"

Defined in: auth/src/auth/TOTPStrategy.ts:21

The name of the request query parameter to retrieve the token from when using query based authentication. Default value is auth_totp.

Methods​

checkRateLimit()?​

optional checkRateLimit(identifier, req): Promise<void>

Defined in: auth/src/auth/TOTPStrategy.ts:39

Optional hook invoked with the claimed identifier before the TOTP token is verified. Implementations should throw to reject the request once a caller-defined attempt threshold has been exceeded (see RateLimiter). A no-op when not provided.

Parameters​

identifier​

string

req​

HttpRequest

Returns​

Promise<void>

getSecrets()​

getSecrets(uid): Promise<TOTPSecret[]>

Defined in: auth/src/auth/TOTPStrategy.ts:45

Retrieves the stored TOTP secrets for the user with the given unique identifier. NOTE: You must override this function when using this strategy.

Parameters​

uid​

string

Returns​

Promise<TOTPSecret[]>

getUser()​

getUser(id): Promise<JWTUser | undefined>

Defined in: auth/src/auth/TOTPStrategy.ts:53

Retrieves the user data for the given unique identifier. NOTE: You must override this function when using this strategy.

Parameters​

id​

string

The unique id of the user that has been successfully authenticated.

Returns​

Promise<JWTUser | undefined>

updateSecretTimeStep()?​

optional updateSecretTimeStep(uid, timeStep): Promise<void>

Defined in: auth/src/auth/TOTPStrategy.ts:64

Persists the given time step as the last one successfully used for the identified secret, so a captured/replayed token within its validity window can't be used to authenticate a second time. Optional — when omitted, successfully-verified TOTP codes remain valid for reuse until they naturally expire.

Parameters​

uid​

string

The unique id of the stored secret (as attached by getSecrets()) that was verified.

timeStep​

number

The RFC 6238 time step at which the token was verified.

Returns​

Promise<void>