How to verify google authenticator code using passport-2fa-totp?

Question

I am implementing two factor authentication using passportjs module [passport-2fa-totp][1]http://www.passportjs.org/packages/passport-2fa-totp/

I am able to successfully register user and store its key.

I am not able to verify totp-code generated by google authenticator app I am using the following code as reference,

`passport.use(new TwoFAStartegy(function (username, password, done) {

// 1st step verification: username and password

User.findOne({ username: username }, function (err, user) {
    if (err) { return done(err); }
    if (!user) { return done(null, false); }
    if (!user.verifyPassword(password)) { return done(null, false); }
    return done(null, user);
});}, function (user, done) {
// 2nd step verification: TOTP code from Google Authenticator

if (!user.secret) {
    done(new Error("Google Authenticator is not setup yet."));
} else {
    // Google Authenticator uses 30 seconds key period
    // https://github.com/google/google-authenticator/wiki/Key-Uri-Format

    var secret = GoogleAuthenticator.decodeSecret(user.secret);
    done(null, secret, 30);
}}));`

I am not able to understand the second step of verification. First of all I don't have access to code field here which needs to be validated and I am also not able to fetch any proper output. It is just returning me Invalid username or password which isn't the case.

Help me out!

Rajat Sharma Rajat Sharma · Accepted Answer · 2019-02-27T14:25:58

Please check that you are getting username, password and code in these exact fields only and not in any other field, because passport-2fa-totp assumes that you are getting in these fields only.

code field will be passed to the second callback of TwoFAStartegy and verify fn will verify the the code.

Maybe, you can get additional info if you do this,

new TwoFAStartegy({ passReqToCallback: true }, (username, password, done) => 
{
// First Callback
}, (req, user, verify) => {
console.log(req) // The request Object
// Use req here
})

Let me know if it helps :)

How to verify google authenticator code using passport-2fa-totp?

1 Answers