EXAMPLE Email code verification, SMS verification, and 2FA (OTP) support

bcksl2 years ago

6

• 

  jmikrut

  2 years ago

  I don't think I've seen an example here yet but I am very interested in this for sure. I would say it'd be great to build in a way to extend our local auth strategy with other auth factors, wherein we could have a way to just "pass in" verification steps or similar

  
  
  

  we probably have about 80% of "extension points" needed for this, and would only need a few more

• 

  bcksl2 years ago

  I'm going to go check out the current implementation and see what I can discover.

• 

  blazehazes2 years ago

  How did you get on with this

• 

  bcksl2 years ago

  https://github.com/ilich/passport-2fa-totp
  
  

  This takes care of the OTP login, which is a step in the right direction, but doesn't deal with having custom/multiple verification steps.

  
  
  @364124941832159242

  Do any of the extension points you mentioned allow hooking the

  verify

  API on an auth collection? That would certainly be a start, allowing you to provide a method which can be called with different params for the different steps (e.g. email, SMS as above). I believe that the email verification with code rather than link could then be done by using the existing method to override

  verify.generateEmailHTML

  . Same can then be done for

  forgotPassword.generateEmailHTML

  , if the

  reset-password

  API can be hooked. SMS verification might need a custom API route if requiring the ability to resend. Similarly, some fiddling would be required to allow the user to change their phone number after create but before verify, but it's doable.

  
  
  

  Realistically, the other thing that would be nice is being able to specify the field(s) to be used to identify a user, which would allow having things like username or username + email for login.

  
  
  

  Beyond that, we go into the territory of using

  disableLocalStrategy

  and setting up the verification, email, login, logout, etc. stuff as a combination of hooks, custom API routes, and either a custom passport auth strategy or a more suitable existing one such as above.

• 

  duda27712 years ago

  Hey, did you find a good solution in the end you could share with us? 🙂

• 

  zawoj10 months ago

  I made it, it's my first YouTube video so forgive me if it's not the best quality but I wanted to share it already and not edit it endlessly

  https://www.youtube.com/watch?v=Tpqt_q7KWPQ