In addition to regular authentication via username/password or SSO, a second layer of security can be configured, permitting access only if:

• A time-based one-time password is supplied, typically generated/stored on a mobile device, or
• A hardware token is activated, such as a Yubikey or other similar product

The Two-Factor Authentication plugin will expose this feature to end-users, allowing them to configure their devices and enabling this enhanced security on their account.

• v8.x
  • NodeBB v4.x compatibility
  • WebSocket connections are now enforced for the second factor, matching the HTTP route protection.
  • Disabling a second factor (TOTP, a WebAuthn device, or all WebAuthn keys) now requires the account password. SSO-only users without a local password are not challenged.
  • When completing the second factor (token, hardware key, or backup code), users can tick "don't ask again on this device for x days". The window (default 30 days) is configurable in the plugin settings, and 0 disables the checkbox. A trusted device is an opaque token recorded against the account and handed to the browser as a long-lived signed cookie, so logging out and logging in again on the same browser skips the second factor; any other device is challenged, the window is enforced server-side (the record expires), and removing the account's second factor revokes every trusted device.
  • A number of security fixes.
• v7.x
  • Logged-in users who have not passed the second-factor are now treated as guests. Prior to this, they were considered logged in, but were not able to physically navigate away from the 2FA challenge.
  • v7.0.2 to v7.2.2 (inclusive) allowed routes mounted to /api/v3 to not be protected by this plugin. This allowed automated processes to interact via API with 2FA-protected accounts without being challenged for a second factor. As of v7.3.0, this exception was removed as best-practice for security.
• v6.x
  • NodeBB v3.x compatibility
• v5.x
  • Allows for multiple concurrent second factors (e.g. TOTP and WebAuthn).
  • The backup code is now considered a second factor, although it is still recommended to be generated when setting up TOTP/Authn
• v4.x
  • NodeBB v2.x compatibility
• v3.x
  • Introduces hardware key support via WebAuthn.
  • This version is fully backwards compatible with v2.x. The major version bump was merely due to the introduction of the new functionality

• Due to browser limitations, the hardware key on mobile devices (especially Android devices) may not be supported. For more information on which devices are and are not supported, please consult this chart

Install the plugin via the ACP/Plugins page.

Token Generation Step

Challenge Step

Thanks to @yLothar and the KEEB.it community for sponsoring WebAuthn and hardware key support.