0 views
Read
#0
Learn 2FA Authentication - Pre-Requisite Skills & Environment Setup
Before building a TOTP-based 2FA feature, you need to master JavaScript and TypeScript, basic password session JWT authentication, and SQL. In this episode you will also set up Node.js 24 LTS, install otplib, qrcode, and express-rate-limit, and install Google Authenticator to test scanning and codes.
August 10, 2026
00
Read
#1
Learn 2FA Authentication - History, Background & Why You Need It
This episode traces the evolution of authentication from passwords to WebAuthn passkeys, the RFC 4226 and RFC 6238 standards that gave birth to HOTP and TOTP, why passwords are weak against credential stuffing, and why the possession factor and enterprise compliance make 2FA a necessity.
August 10, 2026
00
Read
#2
Learn 2FA Authentication - Core Concepts: TOTP & Main Architecture
This episode dissects the anatomy of a TOTP code: the Base32 shared secret, the time counter of the epoch divided by 30 seconds, HMAC-SHA1, and truncation into 6 digits. You will also learn the end-to-end architecture from generating the secret, the QR code, the first verification, up to a two-step login, including the importance of clock synchronization.
August 10, 2026
00
Read
#3
Learn 2FA Authentication - Authentication Foundation: Login & Session
Before adding the 2FA layer, this episode builds the authentication foundation: password registration and login with bcrypt, HttpOnly session cookies and JWT, the user model structure with a TOTP secret column, and the auth endpoint map that will be injected with the MFA challenge in episode 8.
August 10, 2026
00
Read
#4
Learn 2FA Authentication - Generating the Secret & the Otpauth URI
This episode covers generating a random TOTP secret that is unique per user with otplib, assembling the otpauth provisioning URI that Google Authenticator recognizes, encoding the issuer and account, and why RFC 3548 Base32 is the shared language of all authenticator apps.
August 10, 2026
00
Read
#5
Learn 2FA Authentication - QR Code & Frontend Provisioning
This episode turns the provisioning URI into a QR code that Google Authenticator can scan, renders it on the server with qrcode and shows it only once during enrollment, plus designs the Enable 2FA page with a manual secret option for users without a camera.
August 10, 2026
00
Read
#6
Learn 2FA Authentication - First Code Verification (Enrollment Confirm)
This episode closes the enrollment flow: the user enters 6 digits after scanning the QR, the server verifies them with authenticator check and a window tolerance, and only then enables totpEnabled. You will also see when the recovery codes are first displayed.
August 10, 2026
00
Read
#7
Learn 2FA Authentication - Storing the Secret Securely
This episode explains why a TOTP secret must not be stored in plaintext, how to encrypt it with AES-256-GCM using a key from the MFA_ENCRYPTION_KEY environment variable, plus the practices of one secret per user and logging that never includes a secret or a code.
August 10, 2026
00
Read
#8
Learn 2FA Authentication - Login Flow with a 2FA Challenge
This episode turns login into two steps: a password verification that only marks pendingMfa, then a TOTP code verification that finally grants a full session. You will also learn the separation of the /login and /login/mfa endpoints and how to prevent bypassing protected routes before MFA completes.
August 10, 2026
00
Read
#9
Learn 2FA Authentication - Backup & Recovery Codes
This episode covers recovery codes as the way out when the authenticator is lost: creating 10 single-use codes, displaying them once, storing them as hashes like passwords, marking used codes, and replacing the whole batch on regeneration.
August 10, 2026
00