Multi-Factor Authentication (MFA)
TOTP-based two-factor authentication with authenticator app integration, backup recovery codes, and optional SMS fallback.
What's Included
- TOTP secret generation and QR code creation for authenticator apps
- Verification and enablement flow with step-by-step UI
- One-time backup recovery code generation and hashed storage
- MFA login challenge page with authenticator and backup code options
- SMS fallback verification via Twilio
- API routes for MFA setup and verification
Usage
Via CLI
Loading code block...
Via AI Assistant
Ask your AI assistant:
- "Use the MFA pattern from Bootspring"
- "Apply the Bootspring multi-factor authentication pattern to my project"
Key Considerations
- Encrypt TOTP secrets at rest and never store them in plaintext
- Always provide one-time backup recovery codes when MFA is enabled
- Allow clock drift tolerance (window of 1 step) for time-based codes
- Rate limit verification attempts to prevent brute force attacks
- Log all MFA events including enable, disable, and failed verification attempts
Related Patterns
- Session Management - Session handling after MFA
- RBAC - Role-based access with MFA requirements
- JWT - Token handling for MFA state