Adding support for MFA (OTP and FIDO2 etc.)

[nzedler]

Goals

1. Support of OTP tokens, used with e.g. an authenticator app
2. Support of FIDO2 tokens, e.g. a YubiKey or passkey
3. Official support of the CredentialProvider with email and password (in connection with MFA), because otherwise people do it themselves insecure and email magic links are usability wise BS and rely on the security of email account's password.

Non-Goals

1. A discussion about why passwordless is the future. I agree but not via magic links but proper passkeys.
2. Any discussion trying to play this topic down.

Background

As of soon 2024 it is sad that even the biggest auth framework for Nextjs does not support a proper inhouse MFA solution. Due to our own requirements for a customer application, we will be forced to implement it our selves. Implementing OTP is relatively easy using otplib, however we have to add user interfaces, manual email verification etc. which makes it unnessesary time consuming.

Proposal

This feature should be implemented asap. Due to my limited time I'm not able to help, but I can assist with help since I have studied IT Security and I am working as a IT Sec consultant in the industry since 5 years.

[leonschwanitz]

Passkeys support would be nice!

[kyb3r]

Passkeys are supported experimentally now. But has anyone thought of a good flow for MFA 2FA with passkeys. How would you require multiple providers for example to authorise a user.