Lion Cipher Lab
Add TOTP two-factor auth to a web app you build
- AppSec / DevSecOps
- Intermediate
- ~60 min
- Free · no account required
Why it matters
Turning on 2FA is a checkbox for a user; building it is a rite of passage for a developer, and it is where a surprising number of real applications get it subtly wrong. Plenty of tutorials will show you the happy path -- make a secret, show a QR, check the code -- and stop exactly where the security starts. The parts they skip are the parts attackers and auditors care about: was the shared secret encrypted before it hit the database, or sitting there in plaintext for the next breach to scoop up? Can a user who loses their phone still get in without a support-desk backdoor? Can an attacker…
What you'll learn
- adding TOTP 2FA to an app
- Flask basics
- pyotp
- generating a QR provisioning URI
- verifying one-time codes with a drift window
- encrypting a secret at rest
- one-time backup/recovery codes
- rate-limiting login attempts
- why passkeys beat TOTP
Steps in this lab
- What you're building, and the one idea it rests on
- Stand up the app and its dependencies
- Mint a per-user shared secret -- and never in plaintext
- Show the QR the user scans to enrol
- Verify the login code -- with a drift window
- Give users a way back in: one-time backup codes
- Make the endpoint hostile to guessing: rate-limit
- Know the ceiling: TOTP can still be phished