Skip to content

Latest commit

 

History

History
22 lines (14 loc) · 1.51 KB

README.md

File metadata and controls

22 lines (14 loc) · 1.51 KB
Raw

Two-Factor Authentication Sample

A sample that showcases how to implement Two-Factor authentication in a Web API using an external Authenticator app.

Setup

  • Open the appsettings.json file and set the connection string to the database
  • Run the application

How it works

  • Call /api/auth/register to register a new user
  • Call /api/auth/login to get a user token (this is not the JWT and expires after 5 minutes)
  • Call /api/auth/qrcode with the user token to get the QR Code to add the account to the Authenticator app (note: the QR Code can be obtain only once, this is by design in this sample)
  • Call /api/auth/validate with the user token and the OTP code to get the actual JWT

The built-in support for Two-Factor authentication in ASP.NET Core lacks some features. We may want to handle the other options that are provided by the RFC 6238, for example:

  • Getting the time step of OTP verification to check that the code has only been validated once
  • Defining the window of time steps that are considered acceptable for validation

In this case, it is possible to take a look to Otp.Net and use it to implement the OTP verification.