My 2fa implementation (NOT TESTED YET AS I HAVE TO GO):

class MyLocalStrategy extends LocalStrategy {
  async authenticate (authRequest, params) { // eslint-disable-line no-unused-vars
    const { email, password, twoFa } = authRequest

    const result = await this.findEntity(email, omit(params, 'provider'))
    await this.comparePassword(result, password)

    if (result.secondFactor === 'email' && !twoFa) {
      const verifyToken = randomBytes(5).toString('hex').toUpperCase()
      const verifyExpiry = moment().subtract(10, 'minutes').toISOString()
      await this.app.service('api/users').patch(result._id, { verifyToken, verifyExpiry })
      const useMail = this.app.get('email').provider
      if (useMail !== 'postmark' && useMail !== 'mailer') throw new Error('email provider invalid.')
      const emailMessages = this.app.service('api/' + useMail)
      await emailMessages.create({ locale: result.locale || 'en', email: result.email, type: 'secondFactorAuth', emailCode: verifyToken })
      throw new NotAuthenticated('Sent 2FA')
    } else if (result.secondFactor === 'sms' && !twoFa && result.mobileNumber) {
      const verifyToken = parseInt(randomBytes(6).toString('hex'), 16).toString().substr(0, 6)
      const verifyExpiry = moment().subtract(5, 'minutes').toISOString()
      await this.app.service('api/users').patch(result._id, { verifyToken, verifyExpiry })
      await this.app.service('api/twilio-sms').create({ locale: result.locale || 'en', phone: result.mobileNumber, type: 'secondFactorAuth', smsCode: verifyToken })
      throw new NotAuthenticated('Sent 2FA')
    } if (twoFa && result.verifyToken === twoFa && moment(result.verifyExpiry).isBefore(Date.now())) {
      await this.app.service('api/users').patch(result._id, { verifyToken: null, verifyExpiry: null })
    } else if (twoFa && result.verifyToken !== twoFa) {
      throw new NotAuthenticated('Invalid 2FA!')
    } else {
      return {
        authentication: { strategy: this.name },
        user: await this.getEntity(result, params)
      }
    }
  }

  async comparePassword (entity, password) {
    const hash = entity.password
    const tempHash = entity.tempPassword

    if (!hash && !tempHash) {
      throw new NotAuthenticated('User record in the database is missing both "password" and "tempPassword"')
    }
    if (tempHash && !entity.tempPasswordExpiry) {
      throw new NotAuthenticated('Temp password expiry missing!')
    }
    if (tempHash && moment(entity.tempPasswordExpiry).isBefore(Date.now())) {
      throw new NotAuthenticated('Temp password has expired!')
    }

    let result = await bcrypt.compare(password, hash)
    if (!result && tempHash) {
      result = await bcrypt.compare(password, tempHash)
    }
    if (result) {
      return entity
    }

    throw new NotAuthenticated('Invalid login')
  }

  getEntityQuery (query, params) { // eslint-disable-line no-unused-vars
    return Object.assign(query, {
      blocked: { $nin: [true] },
      $limit: 1
    })
  }
}

Please all comments and criticism are welcomed.

Uh oh!

Uh oh!

Two Factor Authentication #1601

Description

Activity

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions