@cryptotaxi247 / documentation
Code Commits Issues Pulls Sessions CI/CD
kartykp/gat-bypass-2fa-docs
@reggi/path-to-regexp dependabot/npm_and_yarn/main/copy-to-clipboard-4.0.2 dependabot/npm_and_yarn/main/eslint-10.4.0 dependabot/npm_and_yarn/main/npmcli/eslint-config-7.0.0 dependabot/npm_and_yarn/main/proc-log-7.0.0 dependabot/npm_and_yarn/npm_and_yarn-826852524d dependabot/npm_and_yarn/npm_and_yarn-ab9a7f4bc2 deprecate-totp-2fa dhei/classic-tokens gat-bypass-2fa-docs jpg619/fix-accessibility-content-flow jpg619/version-bump-tar-2 kartykp/gat-bypass-2fa-docs kartykp/upgrade-path-to-regex main maitxn/version-bump-tar patch-1 reggi/cache-based-on-version reggi/dev-engines reggi/fix-transform-prettier reggi/overrides update-search-sensitivity
mdx 41 lines 3.76 KB
Raw
1 ---
2 title: Requiring 2FA for package publishing and settings modification
3 ---
4
5 import shared from '~/shared.js'
6
7 To protect your packages, as a package publisher, you can require everyone who has write access to a package to have two-factor authentication (2FA) enabled. This will require that users provide 2FA credentials in addition to their login token when they publish the package. For more information, see "[Configuring two-factor authentication][config-2fa]".
8
9 You may also choose to allow publishing with either two-factor authentication _or_ with tokens configured to bypass 2FA (such as legacy [automation tokens][creating-automation-token] or [granular access tokens][creating-granular-access-token] with bypass 2FA enabled). This lets you configure tokens in a CI/CD workflow while still requiring two-factor authentication from interactive publishes. **Since legacy automation tokens are being deprecated, we recommend using granular access tokens with 2FA bypass**, as they provide the same automation capability with additional security features like expiration dates and scope restrictions.
10
11 For CI/CD workflows, consider using [trusted publishing](/trusted-publishers), which provides secure, token-free publishing that automatically enforces strong authentication without requiring manual token management.
12
13 ## Configuring two-factor authentication
14
15 1. <>{shared['user-login'].text}</>
16
17 <>{shared['user-login'].image}</>
18
19 2. Navigate to the package on which you want to require a second factor to publish or modify settings.
20
21 3. Click **Settings**.
22
23 <Screenshot src="/packages-and-modules/securing-your-code/2fa-package-admin.png" alt="Screenshot showing the admin tab on a package page" />
24
25 4. Under "Publishing access", select the requirements to publish a package.
26 1. **Dont require two-factor authentication**
27 With this option, a maintainer can publish a package or change the package settings whether they have two-factor authentication enabled or not. This is the least secure setting.
28
29 2. **Require two-factor authentication or automation tokens or granular access token**
30 With this option, maintainers must have two-factor authentication enabled for their account. If they publish a package interactively, using the `npm publish` command, they will be required to enter 2FA credentials when they perform the publish. However, maintainers may also create a legacy [automation token][creating-automation-token] or a [granular access token][creating-granular-access-token] configured to bypass 2FA and use that to publish. A second factor is _not_ required when using a token configured to bypass 2FA, making it useful for continuous integration and continuous deployment workflows. **Since legacy automation tokens are being deprecated, we recommend using granular access tokens with 2FA bypass**, which provide the same automation capability with better security controls like expiration dates and scope restrictions.
31
32 3. **Require two-factor authentication and disallow tokens**
33 With this option, a maintainer must have two-factor authentication enabled for their account, and they must publish interactively. Maintainers will be required to enter 2FA credentials when they perform the publish. Automation tokens and granular access tokens configured to bypass 2FA cannot be used to publish packages.
34
35 <Screenshot src="/packages-and-modules/securing-your-code/2fa-package-setting.png" alt="Screenshot showing the require two-factor option for a package" />
36
37 5. Click **Update Package Settings**.
38
39 [config-2fa]: configuring-two-factor-authentication
40 [creating-automation-token]: creating-and-viewing-access-tokens#creating-granular-access-tokens-on-the-website
41 [creating-granular-access-token]: creating-and-viewing-access-tokens#creating-granular-access-tokens-on-the-website