Product
Introducing SSO
Streamline your login process and enhance security by enabling Single Sign-On (SSO) on the Socket platform, now available for all customers on the Enterprise plan, supporting 20+ identity providers.
authenticator
Advanced tools
Readme
| Sponsored by ppl
Two- and Multi- Factor Authenication (2FA / MFA) for node.js
There are a number of apps that various websites use to give you 6-digit codes to increase security when you log in:
There are many Services that Support MFA, including Google, Microsoft, Facebook, and Digital Ocean for starters.
This module uses notp
which implements TOTP
(RFC 6238)
(the Authenticator standard), which is based on HOTP
(RFC 4226)
to provide codes that are exactly compatible with all other Authenticator apps and services that use them.
You may also be interested in
node.js api
npm install authenticator --save
command line
npm install authenticator-cli --global
node.js api
'use strict';
var authenticator = require('authenticator');
var formattedKey = authenticator.generateKey();
// "acqo ua72 d3yf a4e5 uorx ztkh j2xl 3wiz"
var formattedToken = authenticator.generateToken(formattedKey);
// "957 124"
authenticator.verifyToken(formattedKey, formattedToken);
// { delta: 0 }
authenticator.verifyToken(formattedKey, '000 000');
// null
authenticator.generateTotpUri(formattedKey, "john.doe@email.com", "ACME Co", 'SHA1', 6, 30);
//
// otpauth://totp/ACME%20Co:john.doe@email.com?secret=HXDMVJECJJWSRB3HWIZR4IFUGFTMXBOZ&issuer=ACME%20Co&algorithm=SHA1&digits=6&period=30
command line
# see help
authenticator --help
# generate a key and display qr code
authenticator --qr
generateKey() // generates a 32-character (160-bit) base32 key
generateToken(formattedKey) // generates a 6-digit (20-bit) decimal time-based token
verifyToken(formattedKey, formattedToken) // validates a time-based token within a +/- 30 second (90 seconds) window
// returns `null` on failure or an object such as `{ delta: 0 }` on success
// generates an `OTPAUTH://` scheme URI for QR Code generation.
generateTotpUri(formattedKey, accountName, issuer, algorithm, digits, period)
OTPAuth Scheme
otpauth://totp/<<ISSUER>>:<<ACCOUNT_NAME>>?secret=<<BASE32_KEY>>&issuer=<<ISSUER>>
otpauth://totp/<<ISSUER>>:<<ACCOUNT_NAME>>?secret=<<BASE32_KEY>>&issuer=<<ISSUER>>&algorithm=<<ALGO>>&digits=<<INT>>&period=<<SECONDS>>
Note that ISSUER
is specified twice for backwards / forwards compatibility.
See https://davidshimjs.github.io/qrcodejs/ and https://github.com/soldair/node-qrcode.
Example use with qrcode.js
in the browser:
'use strict';
var el = document.querySelector('.js-qrcode-canvas');
var link = "otpauth://totp/{{NAME}}?secret={{KEY}}";
var name = "Your Service";
// remove spaces, hyphens, equals, whatever
var key = "acqo ua72 d3yf a4e5 uorx ztkh j2xl 3wiz".replace(/\W/g, '').toLowerCase();
var qr = new QRCode(el, {
text: link.replace(/{{NAME}}/g, name).replace(/{{KEY}}/g, key)
});
All non-alphanumeric characters are ignored, so you could just as well use hyphens or periods or whatever suites your use case.
These are just as valid:
0, 1, 8, and 9 also not used (so that base32). To further avoid confusion with O, o, L, l, I, B, and g you may wish to display lowercase instead of uppercase.
TODO: should this library replace 0 with o, 1 with l (or I?), 8 with b, 9 with g, and so on?
The window is set to +/- 1, meaning each token is valid for a total of 90 seconds (-30 seconds, +0 seconds, and +30 seconds) to account for time drift (which should be very rare for mobile devices) and humans who are handicapped or otherwise struggle with quick fine motor skills (like my grandma).
It doesn't use native node crypto and there are open security issues which have been left unaddressed.
FAQs
Two- / Multi- Factor Authenication (2FA / MFA) for node.js
The npm package authenticator receives a total of 20,549 weekly downloads. As such, authenticator popularity was classified as popular.
We found that authenticator demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Product
Streamline your login process and enhance security by enabling Single Sign-On (SSO) on the Socket platform, now available for all customers on the Enterprise plan, supporting 20+ identity providers.
Security News
Tea.xyz, a crypto project aimed at rewarding open source contributions, is once again facing backlash due to an influx of spam packages flooding public package registries.
Security News
As cyber threats become more autonomous, AI-powered defenses are crucial for businesses to stay ahead of attackers who can exploit software vulnerabilities at scale.