v1.0.0

2fa-node v1.0.0

Fixes

• HOTP now follows RFC 4226, so its tokens match authenticator apps (0.x HOTP tokens never did).
• Empty or invalid secrets are rejected; 0.x accepted a token anyone could compute for them.
• Generated secrets use every bit of each byte (0.x lost one bit per byte).
• The library no longer changes otplib's global settings for the whole process.

New

• verifyTokenOnce accepts each TOTP token only once (replay protection).
• SecretOptions and OtpType types are exported.
• Upgraded to otplib 13 (otplib 12 is deprecated).

Breaking changes

• HOTP tokens differ from 0.x.
• verifyToken and verifyHOTPToken return only true or false (no more null).
• verifyToken accepts 1 step (±30 s) by default instead of 4.
• verifyHOTPToken requires counter and drops the window argument, which never worked.
• numberOfSecretBytes must be at least 16; invalid types, counters and windows throw.
• Secrets must be canonical base32 of at least 80 bits.
• The otpauth URI uses the standard issuer parameter instead of name.
• Only the package entry point can be imported, and Node.js 20.19+ is required.
• License changed from MIT to MPL-2.0.

v0.0.6

This change provides greater flexibility in configuring the number of secret bytes for the authenticator while maintaining backward compatibility.

• Added optional numberOfSecretBytes parameter to the Payload interface to specify the number of authenticator secret bytes (default: 20).

• Added the numberOfSecretBytes parameter in the config to use the value from the Payload or fallback to the default.

• Adjusted and added corresponding test cases to validate the new parameter and ensure compatibility with existing behavior.

Full Changelog: v0.0.5...v0.0.6

Full Changelog: v0.0.5...v0.0.6

v0.0.5

Complete OTP implementation using otplib - TOTP and HOTP

• Added support for TOTP (Time-based One-Time Password) and HOTP (HMAC-based One-Time Password)
• Implemented functions for generating and validating authentication tokens.

Full Changelog: https://github.com/FinotiLucas/2fa-node/commits/v0.0.5