Two-Factor Authentication Server

This project implements a secure backend authentication system with full support for Time-based One-Time Passwords (TOTP). The server enables users to register, generate their own authenticator identity, pair it with an authenticator application (such as Google Authenticator), and complete login using rotating one-time codes. The system offers a production-ready model for modern multi-factor authentication workflows with strong security guarantees.

The backend is built using a modular, maintainable structure with a focus on security, session integrity, and robust identity verification.

---

Features

Core Authentication

• Complete username–password login flow with secure hashing.
• Session-based and token-based authentication support.
• Persistent login management and identity validation.

TOTP-Based 2FA

• Full implementation of Time-based One-Time Password (TOTP) verification.
• Automatic generation of shared secrets for each user.
• QR code generation for easy enrollment into authenticator apps.
• Verification of server-generated and user-submitted OTP values.
• Time-window tolerance to prevent accidental rejection during code rollover.
• User flow designed for pairing, enabling, and confirming multi-factor authentication.

User Management

• Account registration and onboarding pipeline.
• Secure password hashing using industry-standard practices.
• Enforced session protection and user identity checks.
• Storage of 2FA secret keys in a protected and encrypted format.

API Design

• RESTful routes with clear separation of concerns.
• Authentication middleware for guarding protected resources.
• Structured error handling for predictable client interactions.
• JSON-based request and response structure for easy integration.

Database and Persistence

• MongoDB models for user accounts, auth states, and 2FA configuration.
• Well-structured schemas designed for scale and reliability.
• Resilient connection handling and environment-based configuration.

Security Practices

• Strict validation of authentication attempts.
• Protection against replay attacks and brute-force attempts.
• Sanitized input and controlled request parsing.
• Secure environment variable handling.