TechPrufer
Get started
Atlassian
Atlassian logoAtlassian · Feature trail

Atlassian Multi-Factor Authentication Library (1time)

1 post · Nov 2022

What this trail covers

Atlassian has developed and open-sourced its own multi-factor authentication (MFA) library, named '1time', to handle Time-based One-Time Passwords (TOTP). This library strictly adheres to RFC standards (RFC-6238, RFC-4226), addresses issues found in previous libraries such as integer overflow for epoch seconds and lack of support for time windows, and uses property-based testing for extensive validation. The library generates TOTP URLs in Google's Key Uri Format and supports multiple HMAC algorithms.

All Atlassian trails
  1. How Atlassian implemented its own multi-factor authentication library with time-based one-time passwords MFA with TOTP libraryThis post details the technical challenges encountered with existing TOTP libraries, including integer overflow issues leading to incorrect TOTP generation past the year 2038 and the inability to accommodate clock drifts and network delays by not supporting multiple time windows. It highlights the 'magic number' anti-pattern in a previous library that restricted it to SHA1. The post introduces Atlassian's '1time' library, emphasizing its strict adherence to RFC standards, its use of property-based testing, its ability to generate explicit QR codes with all parameters, and its implementation of a configurable time window (defaulting to one past, one current, and one future window) to mitigate verification issues.