SecureTOTP

SecureTOTP is a comprehensive security solution that implements Two-Factor Authentication (2FA) using Time-based One-Time Password (TOTP) algorithm. Built as a microservices application using Spring Boot, this project addresses the growing need for enhanced security measures beyond traditional username and password authentication.

The system generates secure, time-limited verification codes that users must enter alongside their regular credentials. It supports QR code generation for easy setup with authentication apps like Google Authenticator, Microsoft Authenticator, and Authy, creating a seamless yet highly secure user experience.

The project follows a microservices architecture with separate services for authentication, user management, and TOTP operations, ensuring scalability and maintainability for enterprise-level applications.

The application follows a microservices architecture with the following key components:

• Auth Service: Handles user registration, login, and token management with Spring Security and JWT
• TOTP Service: Generates and validates time-based one-time passwords, Manages user PIN setup, storage, and verification for additional authentication layer

Security Implementations

The project implements several layers of security:

• TOTP Generation: Using RFC 6238 compliant HMAC-SHA1 algorithm with 30-second validity
• Secret Key Management: Secure storage of TOTP secret keys with AES-256 encryption
• JWT Authentication: Stateless authentication with short-lived access tokens and refresh tokens
• Password Security: BCrypt password encoding with adaptive work factor
• Rate Limiting: Protection against brute force attacks with IP-based and account-based rate limiting