What You Will Learn

• What MFA is and why it matters.
• Common MFA factors.
• How OTP and TOTP verification works.
• How to design an MFA flow.
• Recovery and production considerations.

Introduction

Multi-factor authentication adds another proof of identity after the password.

It reduces risk when passwords are stolen, guessed, reused, or leaked.

Authentication Factors

Factor	Example
Something you know	Password or PIN
Something you have	Phone, authenticator app, hardware key
Something you are	Fingerprint or face

MFA Login Flow

sequenceDiagram
    participant User
    participant App
    participant MFA
    User->>App: Username and password
    App->>App: Validate password
    App->>MFA: Generate or verify challenge
    MFA-->>App: MFA result
    App-->>User: Token or session

TOTP Basics

TOTP stands for Time-Based One-Time Password.

Authenticator apps generate short codes from:

• A shared secret.
• Current time window.
• A cryptographic algorithm.

The server verifies the same code without sending SMS.

MFA State Model

PASSWORD_VERIFIED -> MFA_REQUIRED -> MFA_VERIFIED -> AUTHENTICATED

This avoids issuing a full access token before the second factor is complete.

Backup Codes

Backup codes help users recover access when they lose their MFA device.

Store backup codes like passwords:

• Hash them.
• Allow one-time use.
• Show them only once.
• Alert users when used.

Production Practices

• Prefer authenticator apps or hardware keys over SMS.
• Rate-limit MFA attempts.
• Expire MFA challenges quickly.
• Log MFA enrollment and failure events.
• Require re-authentication for disabling MFA.
• Provide secure recovery flow.

Summary

MFA strengthens authentication by requiring additional proof beyond a password. Good MFA design includes secure enrollment, verification, recovery, rate limits, and audit logging.

Learning Path Navigation

• Series home: Spring Security Learning Path
• Previous: SAML SSO Integration in Java Applications
• Next: Method-Level Security with PreAuthorize