Node.js Two-Factor Authentication with speakeasy

TL;DR Implementing two-factor authentication (2FA) in Node.js using Speakeasy simplifies securing user accounts and sensitive data. It requires two factors: something you know (password, PIN, or passphrase) and something you have (one-time password via SMS, email, or authenticator app). Speakeasy uses the TOTP algorithm to generate time-synchronized OTPs, making it highly secure and resistant to replay attacks.

Implementing Node.js Two-Factor Authentication with Speakeasy: A Comprehensive Guide

As a Fullstack Developer, ensuring the security of your application is paramount. In today's digital age, two-factor authentication (2FA) has become an essential feature to safeguard user accounts and sensitive data. In this article, we will delve into implementing Node.js Two-Factor Authentication using Speakeasy, a popular 2FA library.

What is Two-Factor Authentication?

Two-Factor Authentication is a security process that requires two different authentication factors to verify the identity of a user. These factors are:

1. Something you know: This can be a password, PIN, or passphrase.
2. Something you have: This can be a one-time password (OTP) sent via SMS, email, or an authenticator app.

Why Speakeasy?

Speakeasy is a Node.js library that simplifies the implementation of two-factor authentication. It uses the TOTP (Time-Based One-Time Password) algorithm to generate time-synchronized OTPs. This makes it highly secure and resistant to replay attacks.

Prerequisites

Before we begin, ensure you have:

1. Node.js installed on your system.
2. npm (Node Package Manager) set up.
3. A basic understanding of Node.js and its ecosystem.

Setup Speakeasy Library

To start, install the Speakeasy library using npm:

npm install speakeasy

Configuring Speakeasy for 2FA

Create a new file called auth.js to store your authentication configuration:

const speakeasy = require('speakeasy');

// Generate secret key (keep this secure)
const SECRET_KEY = 'your_secret_key_here';

// Set up TOTP options
const TOTP_OPTIONS = {
  encoding: 'base32',
  length: 6,
};

module.exports = {
  SECRET_KEY,
  TOTP_OPTIONS,
};

Generating Secret Key

The secret key is used to generate OTPs. Store it securely, as it will be needed for users to authenticate.

Creating User Accounts with 2FA

Create a new file called user.js to store user account information:

const mongoose = require('mongoose');
const bcrypt = require('bcryptjs');

// Define user schema
const userSchema = new mongoose.Schema({
  username: String,
  password: String,
  secretKey: String, // Store secret key for each user
});

module.exports = mongoose.model('User', userSchema);

Implementing 2FA for User Login

Create a new file called login.js to handle user login with 2FA:

const express = require('express');
const router = express.Router();
const User = require('./user');
const speakeasy = require('speakeasy');

router.post('/login', (req, res) => {
  const username = req.body.username;
  const password = req.body.password;

  // Find user by username
  User.findOne({ username }, (err, user) => {
    if (err || !user) {
      return res.status(401).json({ message: 'Invalid credentials' });
    }

    // Verify password
    bcrypt.compare(password, user.password, (err, isMatch) => {
      if (!isMatch) {
        return res.status(401).json({ message: 'Invalid credentials' });
      }

      // Generate OTP using secret key
      const otp = speakeasy.totp({
        encoding: 'base32',
        key: user.secretKey,
      });

      // Return OTP to user for verification
      res.json({ otp, username });
    });
  });
});

Verifying User Identity with 2FA

Create a new file called verify.js to handle 2FA verification:

const express = require('express');
const router = express.Router();
const speakeasy = require('speakeasy');

router.post('/verify', (req, res) => {
  const username = req.body.username;
  const otp = req.body.otp;

  // Find user by username
  User.findOne({ username }, (err, user) => {
    if (err || !user) {
      return res.status(401).json({ message: 'Invalid credentials' });
    }

    // Verify OTP using secret key
    const isValid = speakeasy.totp({
      encoding: 'base32',
      key: user.secretKey,
    }).verify(req.body.otp);

    if (!isValid) {
      return res.status(401).json({ message: 'Invalid OTP' });
    }

    // User authenticated successfully
    res.json({ message: 'User authenticated successfully' });
  });
});

Putting it all Together

To complete the implementation, create an API route that handles user registration and 2FA setup:

const express = require('express');
const router = express.Router();
const User = require('./user');
const speakeasy = require('speakeasy');

router.post('/register', (req, res) => {
  const username = req.body.username;
  const password = req.body.password;

  // Create new user account
  const user = new User({
    username,
    password: bcrypt.hashSync(password, 10),
    secretKey: speakeasy.generateSecret().base32,
  });

  user.save((err) => {
    if (err) {
      return res.status(500).json({ message: 'Error creating user account' });
    }

    // Return user secret key for 2FA setup
    res.json({ secretKey: user.secretKey });
  });
});

Conclusion

In this comprehensive guide, we implemented Node.js Two-Factor Authentication using Speakeasy. This implementation covers user registration with 2FA setup, login verification, and OTP generation. As a Fullstack Developer, understanding the intricacies of security measures like 2FA is crucial to building robust and secure applications.

Example Use Cases

1. Implementing 2FA for user login to protect sensitive data.
2. Using 2FA for password reset or account recovery processes.
3. Integrating 2FA with other security measures, such as IP blocking or behavioral analysis.

By following this guide, you can enhance the security of your Node.js application and provide a robust authentication experience for your users.