4

Related: Implementation flow of MFA with TOTP

I'm trying to implement 2FA with TOTP in my web application.

The implementation I've looked at (the ASP.NET Core implementation of 2FA) does something like this:

  1. Check if username and password are correct
  2. Generate a cookie that contains the userid of the user that just logged in
  3. Redirect the user to a page in which he can insert the TOTP code
  4. The TOTP code is sent to the server, along with the cookie generated at step 2.
  5. If the userid contained in the cookie is correct (there's an actual user with that userid) and the TOTP is valid the user is authenticated.

For reasons I can't get into I can not implement something like that.

Would an implementation consisting of these steps defeat the purpose of 2FA?

  1. Ask the user for username, password and TOTP code
  2. If credentials and TOTP are correct, authenticate the user
2
  • I can't see any reason why it would. Since you're checking both factors, it is still valid 2fa.
    – nobody
    Aug 9, 2022 at 15:09
  • 1
    Why do you think it would defeat the purpose? Aug 9, 2022 at 16:56

1 Answer 1

6

That should be fine, security-wise.

The reason you see sites prompting for 2FA on a separate page are often due to the way the login process is commonly implemented. You might enter your username/password on one page, but depending on the site you're trying to access it also prompts for your token code. Often the username/password system is something like LDAP, Active Directory, FIDO, etc., but the 2FA system is completely independent and is supplied by a different vendor such as RSA, Thales, Google, github, etc., and has a completely different interface.

It turns out it's also more user-friendly to split the token code from your password. If you make a typo in your password, it will simply prompt you to enter it again. Otherwise if you have to enter both up front, you'll expend the effort to pull out your phone, open the 2FA app, enter your PIN, and then enter the token code, only to find out you mistyped your password and have to do it all over again.

1
  • 4
    Another common reason for 2FA is to be on a separate page is that the login flow doesn't know if your account has 2FA until after you provide your username. Asking for 2FA may be confusing to users who don't have 2FA enabled.
    – Brian
    Aug 19, 2022 at 21:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .