The earlier authentication lessons showed how a single factor - a password - fails in practice: it is guessed, reused across sites, leaked in breach dumps, and phished. Two-factor authentication (2FA) answers that weakness by demanding a second, independent piece of evidence at login: not only something you know (the password) but also something you have (a device that generates a short, time-based code).
This sits squarely in A07:2021 - Identification and Authentication Failures. A correctly implemented second factor changes the attacker's problem entirely: even with the right password, they must also possess the user's device at the moment of login. That is why multifactor authentication (MFA) is one of the highest-value defenses a web application can add.
But a second factor is only as strong as its implementation. A factor that can be skipped, brute-forced, or stolen at setup gives a false sense of safety. NovaCart's "Two Factor Authentication" challenge lets you see both halves.
In this lesson you will:
- Open NovaCart's 2FA settings, begin TOTP setup, and read the
otpauth://shared secret the server presents. - Understand how a Time-based One-Time Password is computed from that secret and the current clock, and why no code crosses the network at setup.
- Name the standard behind the 6-digit code.
- Reason about the implementation flaws - no rate limiting, secret leakage, bypassable fallbacks, an unbound verification step - that let an attacker defeat a second factor that is technically "present".
Estimated time: twelve to eighteen minutes.
Prerequisite: the embedded NovaCart application is running and you have completed authentication-login. An authenticator app (or a TOTP utility) is helpful if you want to complete the setup, but is not required to follow the lesson.
Authorization reminder: practice only against the embedded NovaCart application provided by this course. Enabling, brute-forcing, or bypassing two-factor authentication on an account or application you do not own would constitute unauthorized access and is illegal in most jurisdictions.
Course position: this lesson connects authentication-login, session-jwt-security, and captcha-rate-limiting-anti-automation: first-factor login, session continuity, and server-side throttling all have to work for 2FA to mean anything.
When you are ready, send the Continue signal.