NodeBB/nodebb-plugin-2factor
2
0
Fork 0
mirror of https://hk.gh-proxy.com/https://github.com/NodeBB/nodebb-plugin-2factor.git synced 2025-10-03 09:11:01 +08:00
Code Issues Projects Packages Wiki Activity Actions
Two-Factor Authentication for NodeBB
327 commits 5 branches 82 tags 1.3 MiB
Find a file
Julian Lam 1b32abbf11 fix: open redirection vulnerability
2025-09-18 13:32:28 -04:00
docs refactor: update plugin to treat logged-in users who have not passed 2FA check as guests, return standard API error on API calls when 2FA not passed [breaking] 2023-01-10 11:44:03 -05:00
languages translate fin 2024-05-15 11:58:13 -04:00
lib fix: open redirection vulnerability 2025-09-18 13:32:28 -04:00
screenshots Fleshed out Admin Panel Page 2015-07-28 14:22:09 -04:00
static fix: open redirection vulnerability 2025-09-18 13:32:28 -04:00
.gitattributes init 2014-06-04 16:08:24 -04:00
.gitignore init 2014-06-04 16:08:24 -04:00
.npmignore init 2014-06-04 16:08:24 -04:00
commitlint.config.js Allow hardware keys as a second factor, + eslint (#68) 2022-01-07 13:48:19 -05:00
eslint.config.mjs upgrade eslint 2025-05-01 09:48:47 -04:00
library.js fix: open redirection vulnerability 2025-09-18 13:32:28 -04:00
LICENSE updated structure, added MIT license, moved ACP js to its own separate file 2015-03-13 14:05:43 -04:00
package-lock.json 7.5.10 2025-05-01 10:06:42 -04:00
package.json 7.5.10 2025-05-01 10:06:42 -04:00
plugin.json fix: bug where admins without 2fa were sent to 2fa challenge on relogin 2024-10-04 11:56:46 -04:00
README.md docs: update changelog 2023-09-21 14:35:59 -04:00
TRANSLATE.md closes #3 2015-09-16 13:37:19 -04:00
websockets.js fix: utils usage 2022-05-30 11:39:48 -04:00
yarn.lock upgrade eslint 2025-05-01 09:48:47 -04:00

README.md

Two-Factor Authentication for NodeBB

In addition to regular authentication via username/password or SSO, a second layer of security can be configured, permitting access only if:

  • A time-based one-time password is supplied, typically generated/stored on a mobile device, or
  • A hardware token is activated, such as a Yubikey or other similar product

The Two-Factor Authentication plugin will expose this feature to end-users, allowing them to configure their devices and enabling this enhanced security on their account.

Version History

  • v7.x
    • Logged-in users who have not passed the second-factor are now treated as guests. Prior to this, they were considered logged in, but were not able to physically navigate away from the 2FA challenge.
    • v7.0.2 to v7.2.2 (inclusive) allowed routes mounted to /api/v3 to not be protected by this plugin. This allowed automated processes to interact via API with 2FA-protected accounts without being challenged for a second factor. As of v7.3.0, this exception was removed as best-practice for security.
  • v6.x
    • NodeBB v3.x compatibility
  • v5.x
    • Allows for multiple concurrent second factors (e.g. TOTP and WebAuthn).
    • The backup code is now considered a second factor, although it is still recommended to be generated when setting up TOTP/Authn
  • v4.x
    • NodeBB v2.x compatibility
  • v3.x
    • Introduces hardware key support via WebAuthn.
    • This version is fully backwards compatible with v2.x. The major version bump was merely due to the introduction of the new functionality

Caveats

  • Due to browser limitations, the hardware key on mobile devices (especially Android devices) may not be supported. For more information on which devices are and are not supported, please consult this chart

Installation

Install the plugin via the ACP/Plugins page.

Screenshots

Token Generation Step

Token Generation Step

Challenge Step

Challenge Step

Attributions

Keeb.it logo

Thanks to @yLothar and the KEEB.it community for sponsoring WebAuthn and hardware key support.