Skip to content

Is there a Way I can check if a user is already paired with the authenticator app ? #136

Answered by RobThree
Muhsani95 asked this question in Q&A
Discussion options

You must be logged in to vote

When you "pair" a user, you store the secret with the user. So if a user has a secret, (s)he has 2FA enabled (or "paired"). If the user has no secret then (s)he hasn't enabled (or "paired") 2FA.

The QR you show is always for pairing. You then confirm the code generated by the user's app by having them enter the TOTP code, and if that is correct you store the secret (which is the "pairing"). From then on, you never need to show a QR again, you just ask for the TOTP code on login each time.

Where / how you store the secret is up to you, but if your user is stored in, say, as users table then add a totp_secret field or something to the users table and have it nullable. Then, null means "not …

Replies: 1 comment

Comment options

You must be logged in to vote
0 replies
Answer selected by NicolasCARPi
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Category
Q&A
Labels
2 participants