https://github.com/pilcrowonpaper/astro-email-password-2fa
https://github.com/pilcrowonpaper/astro-email-password-2fa
Last synced: 15 days ago
JSON representation
- Host: GitHub
- URL: https://github.com/pilcrowonpaper/astro-email-password-2fa
- Owner: pilcrowonpaper
- Created: 2024-07-22T15:52:22.000Z (9 months ago)
- Default Branch: main
- Last Pushed: 2024-09-24T23:33:14.000Z (7 months ago)
- Last Synced: 2025-03-22T12:22:42.280Z (23 days ago)
- Language: TypeScript
- Size: 430 KB
- Stars: 101
- Watchers: 2
- Forks: 3
- Open Issues: 2
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
- jimsghstars - pilcrowonpaper/astro-email-password-2fa - (TypeScript)
README
# Email and password example with 2FA
Built with Astro and SQLite.
- Password check with HaveIBeenPwned
- Email verification
- 2FA with TOTP
- 2FA recovery codes
- Password reset
- Login throttling and rate limiting
Emails are not actually sent and just logged to the console. Rate limiting is implemented using JS `Map`s.
## Initialize project
Create `sqlite.db` and run `setup.sql`.
```
sqlite3 sqlite.db
```
Create a .env file. Generate a 128 bit (16 byte) string, base64 encode it, and set it as `ENCRYPTION_KEY`.
```bash
ENCRYPTION_KEY="L9pmqRJnO1ZJSQ2svbHuBA=="
```
> You can use OpenSSL to quickly generate a secure key.
> ```bash
> openssl rand --base64 16
> ```
Run the application:
```
pnpm dev
```
## User enumeration
I do not consider user enumeration to be a real vulnerability so please don't open issues on it. If you really need to prevent it, just don't use emails.