Package com.codename1.backend.security.mfa

package com.codename1.backend.security.mfa

A second factor at sign-in: one-time codes from an authenticator app, and the recovery codes that stand in for a lost phone.

http.mfa(...) turns it on for a chain. A user who has enrolled -- see TotpService -- is not signed in by their password alone: the request stays anonymous, and they are sent to a page that asks for the code.

The secret an authenticator app shares with the server is kept by a TotpRepository, in memory or sealed in the server's database; recovery codes are kept as hashes by a RecoveryCodeRepository.

Related Packages

Package	Description
com.codename1.backend.security	Authentication and authorization for the routes of a backend, in the shape of Spring Security: an application declares one or more SecurityFilterChain beans, each built from the HttpSecurity its method is handed, and every request the server does not answer on its own behalf is put to them.
com.codename1.backend.security.apikey	API keys: long-lived secrets a program presents instead of signing in.
com.codename1.backend.security.crypto	Password hashing: the PasswordEncoder contract, the delegating encoder that reads the {id} in front of a stored password, and the encoders behind it.
com.codename1.backend.security.ratelimit	Limits on how often a client may ask: a RateLimiter counts requests under a key, and a RateLimitKeyResolver says which key a request counts under -- its client's address, who it is signed in as, its session, its API key.
com.codename1.backend.security.rememberme	Remember-me: recognizing a returning user by a cookie, so that closing the browser does not sign them out.
com.codename1.backend.security.webauthn	Passkeys: signing in with a credential an authenticator holds, as the Web Authentication specification defines it.

Class	Description
InMemoryRecoveryCodeRepository	Recovery codes kept in this process: gone when it stops.
InMemoryTotpRepository	Secrets kept in this process: gone when it stops.
JdbcRecoveryCodeRepository	Recovery codes kept in the server's database, in the cn1_mfa_recovery_code table of SecuritySchema.
JdbcTotpRepository	Secrets kept in the server's database, in the cn1_mfa_totp table of SecuritySchema.
RecoveryCodeRepository	Where recovery codes are kept: as hashes, never as the codes.
RecoveryCodeService	Recovery codes: what signs a user in when their authenticator app is gone.
TotpCredential	What the server keeps of one user's authenticator app.
TotpEnrollment	What a user needs to add the server to their authenticator app: shown once, when enrolment begins.
TotpRepository	Where the secrets of users' authenticator apps are kept.
TotpService	Time-based one-time codes (RFC 6238): enrolling a user's authenticator app, and checking the codes it shows.