Project description
TranslatedWe run a mature web application with classic email and password login, and we want to raise account security to modern standards. The goal of the project is to design and implement a full-featured two-factor authentication layer together with a set of account protection features, carefully integrated into our existing user model and session logic. We don't need a one-off prototype: we need production-quality code, sensible defaults and a convenient scenario for regular users who don't understand security. The chosen contractor works with our current stack, follows the code conventions adopted in the project and delivers a result that our team can maintain after handover.
Specifically required is TOTP support compatible with common authenticator apps, a channel of one-time codes via email as an alternative second factor and one-time backup codes that users can print or save in case they lose their device. Setup should be step-by-step and reversible: secret delivery via QR, mandatory verification step before 2FA actually activates and a clear recovery path that doesn't lock someone out forever. In parallel we expect proper session management: a readable list of active sessions and devices, the ability to remotely terminate any of them, and login alerts that notify the owner when a new device appears or there's an unusual login attempt. All of this should follow current best practices for secret storage, rate limiting and protection against brute force and code reuse.
The deliverable includes a working set of features, database migrations, administrative toggles where appropriate, automated tests for critical scenarios and brief documentation for our team. In your response describe relevant experience with authentication and security and your approach to access recovery if a user loses both their device and backup codes.
— TOTP via authenticator apps and one-time codes via email as second factors
— One-time backup recovery codes with secure regeneration
— Step-by-step and reversible setup with QR delivery and verification step
— List of active sessions and devices with remote termination
— Login alerts for new device and suspicious login attempts
— Rate limiting, brute force protection and code reuse prevention, secure secret storage
Specifically required is TOTP support compatible with common authenticator apps, a channel of one-time codes via email as an alternative second factor and one-time backup codes that users can print or save in case they lose their device. Setup should be step-by-step and reversible: secret delivery via QR, mandatory verification step before 2FA actually activates and a clear recovery path that doesn't lock someone out forever. In parallel we expect proper session management: a readable list of active sessions and devices, the ability to remotely terminate any of them, and login alerts that notify the owner when a new device appears or there's an unusual login attempt. All of this should follow current best practices for secret storage, rate limiting and protection against brute force and code reuse.
The deliverable includes a working set of features, database migrations, administrative toggles where appropriate, automated tests for critical scenarios and brief documentation for our team. In your response describe relevant experience with authentication and security and your approach to access recovery if a user loses both their device and backup codes.
— TOTP via authenticator apps and one-time codes via email as second factors
— One-time backup recovery codes with secure regeneration
— Step-by-step and reversible setup with QR delivery and verification step
— List of active sessions and devices with remote termination
— Login alerts for new device and suspicious login attempts
— Rate limiting, brute force protection and code reuse prevention, secure secret storage
Web programming Cash, Bank transfer
