If I understand correctly, there is currently no way to enable two-factor authentication (e.g., TOTP or a code sent via email) for app users. SSO (SAML/OIDC) works well for internal staff who already have a company identity provider. For external users, it would mean deploying and maintaining a dedicated identity provider just to get 2FA, which is complicate and disproportionate for small businesses.
Is two-factor authentication for app users on the roadmap? And in the meantime, is there a recommended approach to strengthen login security for external users?
So, after logging in with their password, the user receives a code via email and must enter it to continue.
I’m going to test this out. I’ve already noted that, for the solution to be secure, the code must never appear in a data source, and the time limit and number of attempts must be restricted.
I could be a code, or a link with the code or with an uuid… I guess this is limited by what you can do in the application and workflow builders, but some things seem possible.
Yes I’d like to hear from you implementation, good luck!
Here’s what I’ve tested: two-factor authentication via a code sent by email for Application Builder users, using n8n.
1 The user logs in with their email address and password. Their role is reset to “pending.”
2 On a verification page, a button triggers an n8n webhook (the “Send an HTTP Request” action). n8n generates a 6-digit code, stores only a hash of it along with an expiration time and a limit on the number of attempts, and then sends the code via email.
3 The user enters the code. n8n verifies it and, if valid, changes the user’s role to “verified,” then returns a positive or negative response so that the application can display the appropriate page.
4 Protected pages are visible only to users with the “verified” role.
5 The role is reset to “pending” upon logout, and verification expires after a defined period.
The entire workflow appears to function on a test instance. Before going live, numerous tests still need to be performed.
That said, this is still a workaround: native two-factor authentication for app users, managed by Baserow, would remain the ideal solution.
Hello @tonyf, thanks for sharing what worked for you! I quickly checked with the team, and while 2FA isn’t on the roadmap yet, we do have user source magic links planned. Hope this helps!
,