Freelance › Projects › Administration › Add two-factor authentication and account security to a web app
Add two-factor authentication and account security to a web app
Employer
Igor
Project parameters
Type of cooperationOne-time project
SectionAdministration
Prepaymentwithout prepayment
Payment methodsCash, Bank transfer
Acceptance of requestsfrom today, 19:21 until Aug 30, 2026
Project description
We operate an established web application with a traditional email-and-password login, and we need to raise account security to modern standards. The goal of this project is to design and implement a complete two-factor authentication layer together with a set of account-protection features, integrated cleanly into our existing user model and session flow. We are not looking for a throwaway prototype; we want production-quality code, sensible defaults, and a smooth experience for ordinary users who are not security experts. The chosen contractor will work against our current stack, respect our coding conventions, and deliver something our own team can maintain after handover.
Concretely, we need TOTP support compatible with common authenticator apps, an email one-time-code channel as an alternative second factor, and single-use backup codes that a user can print or save in case they lose their device. Enrollment must be guided and reversible, with QR provisioning, a verification step before 2FA is switched on, and a clear recovery path that does not lock people out permanently. Alongside this, we expect proper session management: a readable list of active sessions and devices, the ability to revoke any of them remotely, and login alerts that notify the account owner when a new device or an unusual sign-in appears. Everything should follow current best practices for secret storage, rate limiting, and protection against brute force and code replay.
Deliverables include the working feature set, database migrations, admin-facing toggles where relevant, automated tests for the critical paths, and concise documentation for our team. Please describe relevant authentication and security experience when you apply, and outline how you would approach account recovery for users who lose both their device and their backup codes.
— TOTP via authenticator apps plus email one-time codes as second factors
— Single-use backup and recovery codes with safe regeneration
— Guided, reversible enrollment with QR provisioning and a verify step
— Active session and device list with remote revoke
— Login alerts for new devices and suspicious sign-ins
— Rate limiting, brute-force and replay protection, secure secret storage
Concretely, we need TOTP support compatible with common authenticator apps, an email one-time-code channel as an alternative second factor, and single-use backup codes that a user can print or save in case they lose their device. Enrollment must be guided and reversible, with QR provisioning, a verification step before 2FA is switched on, and a clear recovery path that does not lock people out permanently. Alongside this, we expect proper session management: a readable list of active sessions and devices, the ability to revoke any of them remotely, and login alerts that notify the account owner when a new device or an unusual sign-in appears. Everything should follow current best practices for secret storage, rate limiting, and protection against brute force and code replay.
Deliverables include the working feature set, database migrations, admin-facing toggles where relevant, automated tests for the critical paths, and concise documentation for our team. Please describe relevant authentication and security experience when you apply, and outline how you would approach account recovery for users who lose both their device and their backup codes.
— TOTP via authenticator apps plus email one-time codes as second factors
— Single-use backup and recovery codes with safe regeneration
— Guided, reversible enrollment with QR provisioning and a verify step
— Active session and device list with remote revoke
— Login alerts for new devices and suspicious sign-ins
— Rate limiting, brute-force and replay protection, secure secret storage
