Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/jimmytuc/node-authenticator
Two- / Multi- Factor Authenication (2FA / MFA / OTP) for node.js
https://github.com/jimmytuc/node-authenticator
Last synced: 5 days ago
JSON representation
Two- / Multi- Factor Authenication (2FA / MFA / OTP) for node.js
- Host: GitHub
- URL: https://github.com/jimmytuc/node-authenticator
- Owner: jimmytuc
- License: apache-2.0
- Created: 2016-08-01T07:05:21.000Z (over 8 years ago)
- Default Branch: master
- Last Pushed: 2016-01-02T09:25:55.000Z (about 9 years ago)
- Last Synced: 2024-03-15T14:05:15.325Z (10 months ago)
- Language: JavaScript
- Homepage:
- Size: 15.6 KB
- Stars: 0
- Watchers: 1
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
Node.js Authenticator
=====================
Two- and Multi- Factor Authenication (2FA / MFA) for node.js
There are a number of apps that various websites use to give you 6-digit codes to increase security when you log in:
* Authy (shown above) [iPhone](https://itunes.apple.com/us/app/authy/id494168017?mt=8) | [Android](https://play.google.com/store/apps/details?id=com.authy.authy&hl=en) | [Chrome](https://chrome.google.com/webstore/detail/authy/gaedmjdfmmahhbjefcbgaolhhanlaolb?hl=en) | [Linux](https://www.authy.com/personal/) | [OS X](https://www.authy.com/personal/) | [BlackBerry](https://appworld.blackberry.com/webstore/content/38831914/?countrycode=US&lang=en)
* Google Authenticator [iPhone](https://itunes.apple.com/us/app/google-authenticator/id388497605?mt=8) | [Android](https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2&hl=en)
* Microsoft Authenticator [Windows Phone](https://www.microsoft.com/en-us/store/apps/authenticator/9wzdncrfj3rj) | [Android](https://play.google.com/store/apps/details?id=com.microsoft.msa.authenticator)
* GAuth [FxOS](https://marketplace.firefox.com/app/gauth/)
There are many [Services that Support MFA](http://lifehacker.com/5938565/heres-everywhere-you-should-enable-two-factor-authentication-right-now),
including Google, Microsoft, Facebook, and Digital Ocean for starters.
This module uses [`notp`](https://github.com/guyht/notp) which implements `TOTP` [(RFC 6238)](https://www.ietf.org/rfc/rfc6238.txt)
(the *Authenticator* standard), which is based on `HOTP` [(RFC 4226)](https://www.ietf.org/rfc/rfc4226.txt)
to provide codes that are exactly compatible with all other *Authenticator* apps and services that use them.
Browser & Commandline Authenticator
---------------------
You may also be interested in
* [Browser Authenticator](https://github.com/Daplie/browser-authenticator) over at
* [Commandline Authenticator](https://github.com/Daplie/authenticator-cli) over at
Install
=====
**node.js api**
```bash
npm install authenticator --save
```
**command line**
```bash
npm install authenticator-cli --global
```
Usage
=====
**node.js api**
```javascript
'use strict';
var authenticator = require('authenticator');
var formattedKey = authenticator.generateKey();
// "acqo ua72 d3yf a4e5 uorx ztkh j2xl 3wiz"
var formattedToken = authenticator.generateToken(formattedKey);
// "957 124"
authenticator.verifyToken(formattedKey, formattedToken);
// { delta: 0 }
authenticator.verifyToken(formattedKey, '000 000');
// null
authenticator.generateTotpUri(formattedKey, "[email protected]", "ACME Co", 'SHA1', 6, 30);
//
// otpauth://totp/ACME%20Co:[email protected]?secret=HXDMVJECJJWSRB3HWIZR4IFUGFTMXBOZ&issuer=ACME%20Co&algorithm=SHA1&digits=6&period=30
```
**command line**
```
# see help
authenticator --help
# generate a key and display qr code
authenticator --qr
```
API
---
```javascript
generateKey() // generates a 32-character (160-bit) base32 key
generateToken(formattedKey) // generates a 6-digit (20-bit) decimal time-based token
verifyToken(formattedKey, formattedToken) // validates a time-based token within a +/- 30 second (90 seconds) window
// returns `null` on failure or an object such as `{ delta: 0 }` on success
// generates an `OTPAUTH://` scheme URI for QR Code generation.
generateTotpUri(formattedKey, accountName, issuer, algorithm, digits, period)
```
**OTPAuth Scheme**
*
* `otpauth://totp/<>:<>?secret=<>&issuer=<>`
* `otpauth://totp/<>:<>?secret=<>&issuer=<>&algorithm=<>&digits=<>&period=<>`
Note that `ISSUER` is specified twice for backwards / forwards compatibility.
QR Code
-------
See and .
Example use with `qrcode.js` in the browser:
```javascript
'use strict';
var el = document.querySelector('.js-qrcode-canvas');
var link = "otpauth://totp/{{NAME}}?secret={{KEY}}";
var name = "Your Service";
// remove spaces, hyphens, equals, whatever
var key = "acqo ua72 d3yf a4e5 uorx ztkh j2xl 3wiz".replace(/\W/g, '').toLowerCase();
var qr = new QRCode(el, {
text: link.replace(/{{NAME}}/g, name).replace(/{{KEY}}/g, key)
});
```
Formatting
----------
All non-alphanumeric characters are ignored, so you could just as well use hyphens
or periods or whatever suites your use case.
These are just as valid:
* "acqo ua72 d3yf a4e5 - uorx ztkh j2xl 3wiz"
* "98.24.63"
0, 1, 8, and 9 also not used (so that base32).
To further avoid confusion with O, o, L, l, I, B, and g
you may wish to display lowercase instead of uppercase.
TODO: should this library replace 0 with o, 1 with l (or I?), 8 with b, 9 with g, and so on?
90-second Window
----------------
The window is set to +/- 1, meaning each token is valid for a total of 90 seconds
(-30 seconds, +0 seconds, and +30 seconds)
to account for time drift (which should be very rare for mobile devices)
and humans who are handicapped or otherwise struggle with quick fine motor skills (like my grandma).
Why not SpeakEasy?
------------------
It doesn't use native node crypto and there are open security issues which have been left unaddressed.