{"id":4013,"date":"2026-10-27T06:01:02","date_gmt":"2026-10-26T23:01:02","guid":{"rendered":"https:\/\/sumberlaba.com\/index.php\/2026\/10\/27\/how-to-implement-two-factor-authentication-in-your-web-app\/"},"modified":"2026-10-27T06:01:03","modified_gmt":"2026-10-26T23:01:03","slug":"how-to-implement-two-factor-authentication-in-your-web-app","status":"publish","type":"post","link":"https:\/\/sumberlaba.com\/index.php\/2026\/10\/27\/how-to-implement-two-factor-authentication-in-your-web-app\/","title":{"rendered":"How to Implement Two-Factor Authentication in Your Web App"},"content":{"rendered":"

How to Implement Two-Factor Authentication in Your Web App<\/h1>\n

Two-factor authentication (2FA) adds a second proof of identity beyond a password, blocking most account takeover attacks. This tutorial walks through a practical TOTP-based implementation you can ship in an afternoon.<\/p>\n

You will need a backend framework, a database, and one library: otplib<\/code> for Node, pyotp<\/code> for Python, or rotp<\/code> for Ruby.<\/p>\n

\"Article<\/p>\n

Step 1: Choose Your 2FA Method<\/h2>\n

Time-based one-time passwords (TOTP) work with any authenticator app, cost nothing to send, and resist SIM-swap attacks. Prefer them over SMS unless accessibility requirements demand otherwise.<\/p>\n

Step 2: Handle Enrollment<\/h2>\n

When a user enables 2FA, generate a random base32 secret, encrypt it against the user record, and render it as a QR code plus a manual text key.<\/p>\n

    \n
  • Generate the secret with authenticator.generateSecret()<\/code><\/li>\n
  • Build an otpauth:\/\/<\/code> URI with issuer and account labels<\/li>\n
  • Do not activate 2FA until the user confirms one valid code<\/li>\n<\/ul>\n

    Step 3: Verify at Login<\/h2>\n

    After a correct password, mark the session as “pending 2FA” and require a six-digit code. Verify with a one-step window to tolerate clock drift, then promote the session to fully authenticated.<\/p>\n

    Step 4: Prevent Lockouts and Abuse<\/h2>\n
      \n
    • Generate ten single-use recovery codes and store them hashed<\/li>\n
    • Rate-limit verification attempts to about five per fifteen minutes<\/li>\n
    • Log every enable or disable event and email the user on changes<\/li>\n<\/ul>\n

      Conclusion<\/h2>\n

      Start with TOTP, confirm enrollment before activation, and always ship recovery codes. A modest amount of code buys a large jump in account security.<\/p>\n","protected":false},"excerpt":{"rendered":"

      How to Implement Two-Factor Authentication in Your Web App Two-factor authentication (2FA) adds a second proof of identity beyond a password, blocking most account takeover attacks. This tutorial walks through a practical TOTP-based implementation you can ship in an afternoon. You will need a backend framework, a database, and one library: otplib for Node, pyotp … <\/p>\n","protected":false},"author":2716,"featured_media":4012,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-4013","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-non-category"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/sumberlaba.com\/index.php\/wp-json\/wp\/v2\/posts\/4013","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sumberlaba.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sumberlaba.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sumberlaba.com\/index.php\/wp-json\/wp\/v2\/users\/2716"}],"replies":[{"embeddable":true,"href":"https:\/\/sumberlaba.com\/index.php\/wp-json\/wp\/v2\/comments?post=4013"}],"version-history":[{"count":1,"href":"https:\/\/sumberlaba.com\/index.php\/wp-json\/wp\/v2\/posts\/4013\/revisions"}],"predecessor-version":[{"id":4014,"href":"https:\/\/sumberlaba.com\/index.php\/wp-json\/wp\/v2\/posts\/4013\/revisions\/4014"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/sumberlaba.com\/index.php\/wp-json\/wp\/v2\/media\/4012"}],"wp:attachment":[{"href":"https:\/\/sumberlaba.com\/index.php\/wp-json\/wp\/v2\/media?parent=4013"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sumberlaba.com\/index.php\/wp-json\/wp\/v2\/categories?post=4013"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sumberlaba.com\/index.php\/wp-json\/wp\/v2\/tags?post=4013"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}