2 factor authentication with Spring Security

In this lesson of our #springsecuritytutorial, we will take a look at the #2factorauthentication or also known as #mfa with #spring. This multi factor authentication with #SpringSecurity help us to add an additional layer of #security on the top of standard spring security #authentication.
#twofactorauthentication, referred to as two-step verification or dual-factor authentication, is a security process in which users provide two different authentication factors to verify themselves.
We will be using one external API to generate the TOTP and validate the #securitytoken. We will also be creating a custom authentication provider to hook the token validation in the authentication process.
#multifactorauthentication #securityannotation #springsecuritycourse #springsecuritytutorials #security #springboot #springmvc #springframework #customauthenticationprovider #authenticationprovider #2fa #mfa
Two Factor Authentication with Spring Security - www.javadevjournal.com/spring...
Spring Security Custom Authentication Provider - www.javadevjournal.com/spring...
Additional parameter with spring security login page - www.javadevjournal.com/spring...
Spring Security Roles and Permissions - www.javadevjournal.com/spring...
Spring Security Course - www.javadevjournal.com/spring...

[@sagarsri4143]

Good Concept 👌 Superb Explanation

[@javadevjournal]

Thanks!!!!

[@ragapranathi3748]

Hello I am a complete beginer in spring It would be really useful if you had started the video from which IDE you have used and how you downloaded and added spring dependencies in a new project. I hope you could at least let us know the steps in the comments.
hope you see this and reply.
thanks.

[@fabrizioferroni609]

Hello, I see that what you did is in an mvc in spring boot, how could this be taken to a rest api in spring boot for example and consuming it with a frontend made in Angular? Sorry for my English which is not good

[@maqhobelakao2045]

This work which app do i use to scan qr

[@hardikchawla4966]

Is it possible to use basic authentication and oauth2 together? We will decide which one to use based on header

[@javadevjournal]

you can but mixing is not a good way to do that, you can always skip/ pass the auth based on header value or have a different auth type based on the entry point

[@Arif-um3ph]

hi, very nice video, can you make a web design playlist, such as login page, dashboard page, admin page etc, thanks

[@javadevjournal]

Thanks for the idea!

[@xuaniennguyen6573]

Hi, thanks for this very helpful video.
Is there a way to separate username/password input and token input?
Example :
Spring Security will have 2 steps.
Step 1 authenticates username/password.
Step 2 if username/password is correct, the input token will appear and the user enters the code => if the code is correct, the authentication process is completely successful.

[@javadevjournal]

yes..you can do that..in 2FA..token validation is always a independent step..you can inject and use the token validation service seperately

[@vladyslavsolopov5013]

Just interesring, why do you use @Resource instead of @Autowiring ?

[@javadevjournal]

It need a entire blog post to go through the detail :). have a look at stackoverflow.com/questions/4093504/resource-vs-autowired

[@rahulbabbar1680]

Nice excplain, but i am confused in some steps, i am not able to see code on github.
can you please share the link.. ?

[@javadevjournal]

Here is the code github.com/javadevjournal/javadevjournal/tree/master/spring-security/spring-security-series/src/main/java/com/javadevjournal/core/security/mfa

[@swatisagar2565]

Hi Sir.i am getting this error while executing this project,could you please me to resolve this issue

[@javadevjournal]

what error? Can you share that plz

[@depression_plusplus6120]

Does this work with react. Why everybody uses jsp only...sucks

[@javadevjournal]

all you need a REST API..Spring security will work as is, you may need stateless option

[@depression_plusplus6120]

Yes, eggzactly
Flow is as follows :-
Username password. I will use manager.autheticate and if it's authenticated. I'll proceed. Now, since I'm doing stateless architecture. What am I gonna send to the user to verify his OTP.
Also, doing a stateless Architecture, does it makes those requestMatches.authenticated. permit all redundant?...cuz they use the state on the server. Please answer

[@vladyslavsolopov5013]

FYI: this library has vulnerability. So recommend do not use this library.
The message:
Provides transitive vulnerable dependency com.beust:jcommander:1.72 Inclusion of Functionality from Untrusted Control Sphere vulnerability pending CVSS allocation.
Status: high 8.1/10
Summary:
jcommander prior to 1.78 includes dependencies over HTTP instead of HTTPS, and thus the included contents could have been compromised and still used as trusted. Show Less

[@vladyslavsolopov5013]

resolve. the reson in one dependecy you couldn't use. Fix is an below:
dev.samstevens.totp
totp
1.7.1

com.beust
jcommander