Security Settings
<%= if @totp_configured do %>
✓ Two-factor authentication is enabled
<% else %>
⚠ Two-factor authentication is not set up
<.link navigate={~p"/auth/totp/setup"} class="btn">
Set up 2FA
<% end %>
"""
end
end
```
## Creating a Custom on_mount Hook
For more control over 2FA requirements:
```elixir
defmodule MyAppWeb.Require2FA do
import Phoenix.Component
import Phoenix.LiveView
alias AshAuthentication.Phoenix.TotpHelpers
def on_mount(:require_2fa, _params, _session, socket) do
user = socket.assigns[:current_user]
cond do
is_nil(user) ->
{:halt, redirect(socket, to: "/sign-in")}
not TotpHelpers.totp_configured?(user, MyApp.Accounts.User) ->
socket =
socket
|> put_flash(:error, "Please set up two-factor authentication to continue")
|> redirect(to: "/auth/totp/setup")
{:halt, socket}
true ->
{:cont, assign(socket, :totp_configured, true)}
end
end
def on_mount(:optional_2fa, _params, _session, socket) do
user = socket.assigns[:current_user]
configured = user && TotpHelpers.totp_configured?(user, MyApp.Accounts.User)
{:cont, assign(socket, :totp_configured, configured || false)}
end
end
```
Use in router:
```elixir
ash_authentication_live_session :admin,
on_mount: [{MyAppWeb.Require2FA, :require_2fa}] do
live "/admin", AdminLive
end
ash_authentication_live_session :user,
on_mount: [{MyAppWeb.Require2FA, :optional_2fa}] do
live "/dashboard", DashboardLive
end
```
## Grace Period for Setup
Allow users a grace period to set up 2FA:
```elixir
defmodule MyAppWeb.Require2FAWithGrace do
import Phoenix.Component
import Phoenix.LiveView
alias AshAuthentication.Phoenix.TotpHelpers
@grace_period_days 7
def on_mount(:require_2fa_with_grace, _params, _session, socket) do
user = socket.assigns[:current_user]
cond do
is_nil(user) ->
{:halt, redirect(socket, to: "/sign-in")}
TotpHelpers.totp_configured?(user, MyApp.Accounts.User) ->
{:cont, assign(socket, :totp_configured, true)}
within_grace_period?(user) ->
socket =
socket
|> assign(:totp_configured, false)
|> assign(:grace_period_remaining, days_remaining(user))
|> put_flash(:warning, "Please set up 2FA within #{days_remaining(user)} days")
{:cont, socket}
true ->
socket =
socket
|> put_flash(:error, "Two-factor authentication is now required")
|> redirect(to: "/auth/totp/setup")
{:halt, socket}
end
end
defp within_grace_period?(user) do
days_remaining(user) > 0
end
defp days_remaining(user) do
created = user.inserted_at
deadline = DateTime.add(created, @grace_period_days, :day)
DateTime.diff(deadline, DateTime.utc_now(), :day) |> max(0)
end
end
```
## Security Best Practices
### Enforce TOTP for Sensitive Operations
Even if a user has authenticated with password + TOTP, consider requiring fresh TOTP verification for sensitive operations:
```elixir
defmodule MyAppWeb.AdminLive do
use MyAppWeb, :live_view
def handle_event("delete_user", %{"id" => id}, socket) do
# Require recent TOTP verification for destructive actions
if recent_totp_verification?(socket.assigns.current_user) do
# Proceed with deletion
{:noreply, socket}
else
{:noreply,
socket
|> put_flash(:error, "Please verify your identity with your authenticator app")
|> push_navigate(to: "/verify-identity?return_to=/admin")}
end
end
defp recent_totp_verification?(user) do
case user.__metadata__[:totp_verified_at] do
nil -> false
verified_at -> DateTime.diff(DateTime.utc_now(), verified_at, :minute) < 15
end
end
end
```
### Backup Codes
Consider implementing backup codes for users who lose access to their authenticator app. This is not built into `ash_authentication` by default but can be implemented as a custom strategy.
### Account Recovery
Have a process for users who lose both their password and TOTP access. This typically involves identity verification through support channels.
## Next Steps
- [TOTP Authentication](totp.md) - Using TOTP as primary authentication
- [LiveView Integration](liveview.md) - Setting up authentication in LiveView
- [UI Overrides](ui-overrides.md) - Customising authentication UI