How to Test one 2FA backup-code about recovery

[antonioribeiro]

Yes, this is pretty much what I would do. Just make sure your backup-codes are encrypted in the database

[diadal]

Yes?? how, is it auto accepted by 2fa or I need to create different method to test

[antonioribeiro]

2FA does not auto accept backup codes, this is something you have code to help your users restore access to a lost account, if they loose access to the 2FA device (cellphone usually). You don't really have to have backup codes, this is up to you, you could, for example, restore an user's account by sending a new confirmation e-mail, or an SMS, just to be sure it's not someone else trying to steal an account.

2FA (Google2FA) is time based, there are no backup codes to be used with it, which could be stored for later check, it's not how it works.

The YES for your first post was: "Yes, this is how you the process of enabling 2FA for an user should be".

[diadal]

thank for the details I working with laravel and I check the 2fa code I guess the only way is to use the backup code to disable the 2fa as google2fa_secret this is not null the 2fa fired other way to empty @ login and restore @ logout

[antonioribeiro]

You would have, probably, to put your "recover via backup code" route out of the "2fa" middleware, if you keep this route in the 2fa middleware, it will, of course, keep asking for it.