Skip to main content
M
miki
Known Participant
May 4, 2020
Question

Implementation time for Multi Factor Authentication using TOTP

  • May 4, 2020
  • 2 replies
  • 3966 views

our security team wants us to implement Multi Factor Authentication using a token based system.  I located https://github.com/marcins/cf-google-authenticator which references CF10 and i was pleased becasue we still haven't been approved to move our app from CF 11 to a supported version but beyond serving as a sample has anybody got any idea how long it might take to implement either google authenticator OR another token based system.

 

I'm being told that other 2FA methods are not approved (SMS, Email, etc) because they are not secure so they aren't options at this time.

 

Any Advice, Recommendations, or realtime experience (it took us x long) would be appreciated.  I hope this wasn't too vague, i just don't want to put too much in the post.

2 replies

J
jeffery_6835
New Participant
July 23, 2025

You could look into using a dedicated MFA server (example linked).   A dedicated server wouldn't just allow for multip authentication methods to be used with your site, but could also be used to protect access to other applications (windows logon, VPN access etc).

James Moberg
James Moberg
Inspiring
June 9, 2020

I recently added TOTP (Time-Based One-Time) to our login framework using the CF-Google-Authenticator CFC using ColdFusion 2016, but it should work with CF9.  It was pretty easy to integrate and worked right out of the box.  It took me a couple hours to refactor, test and roll out.  I also added SMS & Email 2FA at the same time.
https://github.com/marcins/cf-google-authenticator

Regarding using a mobile app, I recommend using Authy over Google Authenticator:
https://authy.com/

 

Here are some best practices when integrating the MFA INPUT field:
https://www.twilio.com/blog/html-attributes-two-factor-authentication-autocomplete

 

 

Dani Szwarc
Dani Szwarc
Inspiring
May 3, 2022

Hello James, would you mind sharing your steps on how you were able to set it up?

I am somehow lost at this point after trying with DUO, Authy and I am not able to understand the implementation process.

Thank you very much in advance!

 

Dani

James Moberg
James Moberg
Inspiring
May 3, 2022

Here's an alternative CFML library. (I'm not sure if it will work with CF11, but ColdBox/WireBox is not required in order to use it.)  There's a one-page demo that should provide some insight.  It's maintained (updated 21 hours ago), has documentation and you could reach out for more assistance if you need help.
https://github.com/coldbox-modules/totp



 

Terms & ConditionsAccessibility statement
Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices