Authentication & Authorization Architecture · Strong Authentication and Federation
MFA and Passkeys
Add multi-factor authentication and move toward phishing-resistant passkeys.
MFA blocks most account takeovers from stolen passwords. Factors differ in strength: SMS codes are vulnerable to SIM swaps and phishing; TOTP apps are better; WebAuthn/FIDO2 (security keys and passkeys) are phishing-resistant because credentials are bound to the website's origin. Passkeys are discoverable WebAuthn credentials synced across a user's devices by their platform (Apple, Google, Microsoft, password managers), enabling passwordless login.
WebAuthn registration (simplified)
server → options {challenge, rp: {id: "example.com"}, user: {id, name}, pubKeyCredParams, authenticatorSelection: {residentKey: "required"}}
browser → navigator.credentials.create({ publicKey: options }) // user verifies with biometrics/PIN
browser → server: attestation {credentialId, publicKey, clientDataJSON, ...}
server → verify challenge + origin + rpId; store credentialId + publicKey for the user
Authentication
server → {challenge, rpId}; browser → navigator.credentials.get(...) → signed assertion
server → verify signature with stored public key, origin, rpId, sign counter
Common pitfalls
- SMS as the only MFA option for high-value accounts.
- Recovery flows that bypass MFA entirely (email-only reset).
- Rolling your own WebAuthn verification instead of using a vetted library.
Key points
- MFA stops most credential-based takeovers
- WebAuthn/passkeys are phishing-resistant
- Protect recovery as strongly as login
Further reading: passkeys.dev
Practice questions
Why are passkeys phishing-resistant but TOTP codes aren't?
Answer
A WebAuthn credential is scoped to the site's origin, so the browser won't use it on a look-alike domain; a TOTP code can be typed into a phishing page and relayed in real time.
What's the main operational challenge when enforcing MFA?
Answer
Account recovery: users lose devices, so you need secure fallback (multiple authenticators, recovery codes, verified support processes) without creating a bypass.
Open in the app to mark lessons complete, take notes and track your progress.