Mention WebAuthn as an option for 2FA. (#7)
Co-authored-by: Dominik Bamberger <b4mboo@users.noreply.github.com> Co-authored-by: Myles Borins <mylesborins@github.com> Co-authored-by: Monish C Mohan <23190045+monishcm@users.noreply.github.com>
Dominik Bamberger committed
May 10, 2022 at 17:43 UTC
88551ba87abd820d9544c0e90c072d78ad96b183
28 files changed
+269
-75
.DS_Store
Binary files /dev/null and b/.DS_Store differ
.github/workflows/license-compliance.yml
+4
-1
@@ -1,6 +1,9 @@
1
name: REUSE Compliance Check
2
3
-on: [pull_request]
3
+on:
4
+ push:
5
+ branches: [ main ]
6
+ workflow_dispatch:
7
8
jobs:
9
test:
.github/workflows/publish.yml
+1
@@ -3,6 +3,7 @@ name: Publish
3
on:
4
push:
5
branches: [ main ]
6
+ workflow_dispatch:
7
8
jobs:
9
build:
content/getting-started/setting-up-your-npm-user-account/about-two-factor-authentication.mdx
+35
-18
@@ -5,10 +5,14 @@ redirect_from: [ /getting-started/using-two-factor-authentication ]
5
6
Two-factor authentication (2FA) protects against unauthorized access to your account by confirming your identity using:
7
8
-* something you know (such as your username and password)
9
-* something you have (such as a phone or tablet)
8
+* Something you know (e.g., a password).
9
+* Something you have (e.g., an ID badge or a cryptographic key).
10
+* Something you are (e.g., a fingerprint or other biometric data).
11
11
-When you enable 2FA, we will prompt you for a unique one-time password when you perform certain actions on your account or on packages to which you have write access, depending on your 2FA configuration.
12
+When you enable 2FA, you will be prompted for a second form of authentication before performing certain actions on your account or packages to which you have write access. Depending on your 2FA configuration you will be either prompted to authenticate with a security-key or a [time-based one-time password (TOTP)][totp].
13
+
14
+* The security-key flow allows you to use biometric devices such as Apple [Touch ID][touch-id], [Face ID][face-id] or [Windows Hello][windows-hello] as well as physical keys such as [Yubikey][yubikey], [Thetis][thetis] or [Feitian][feitian] as your 2FA.
15
+* To configure TOTP you will need to install an authenticator application that can generate OTPs such as [Authy][authy], [Google Authenticator][google-authenticator], or [Microsoft Authenticator][microsoft-authenticator] on your mobile device.
16
17
<Note>
18
@@ -16,24 +20,13 @@ When you enable 2FA, we will prompt you for a unique one-time password when you
20
21
</Note>
22
19
-## Two-factor authentication modes on npm
20
-
21
-Two-factor authentication on npm can be enabled for authorization only, or authorization and writes.
22
-
23
-### Authorization only
24
-
25
-If you enable 2FA for authorization only, we will request a one-time password for certain authorized actions.
23
+## Two-factor authentication on npm
24
27
-| Action | CLI command |
28
-| :------------------------------------------------ | :--------------------------------- |
29
-| Log in to npm | `npm login` |
30
-| Change profile settings (including your password) | `npm profile set` |
31
-| Change 2FA modes for your user account | `npm profile enable-2fa auth-only` |
32
-| Disable 2FA for your user account | `npm profile disable-2fa` |
25
+Two-factor authentication on npm can be enabled for authorization and writes, or authorization only.
26
27
### Authorization and writes
28
36
-If you enable 2FA for authorization and writes, we will request a one-time password for certain authorized actions, as well as write actions.
29
+By default, 2FA is enabled for authorization and writes. We will request a second form of authentication for certain authorized actions, as well as write actions.
30
31
| Action | CLI command |
32
| :------------------------------------------------ | :----------------------------------------------------- |
@@ -50,6 +43,17 @@ If you enable 2FA for authorization and writes, we will request a one-time passw
43
| Change user and team package access | [`npm access grant/revoke`][access] |
44
| [Change package 2FA requirements][pkg-2fa] | [`npm access 2fa-required/2fa-not-required`][access] |
45
46
+### Authorization only
47
+
48
+If you enable 2FA for authorization only. We will request a second form of authentication only for certain authorized actions.
49
+
50
+| Action | CLI command |
51
+| :------------------------------------------------ | :--------------------------------- |
52
+| Log in to npm | `npm login` |
53
+| Change profile settings (including your password) | `npm profile set` |
54
+| Change 2FA modes for your user account | `npm profile enable-2fa auth-only` |
55
+| Disable 2FA for your user account | `npm profile disable-2fa` |
56
+
57
58
[login]: https://docs.npmjs.com/cli/adduser
59
[profile-set]: https://docs.npmjs.com/cli/profile
@@ -61,4 +65,17 @@ If you enable 2FA for authorization and writes, we will request a one-time passw
65
[unpublish]: https://docs.npmjs.com/cli/unpublish
66
[deprecate]: https://docs.npmjs.com/cli/deprecate
67
[access]: https://docs.npmjs.com/cli/access
64
-[pkg-2fa]: requiring-2fa-for-package-publishing-and-settings-modification
68
+[pkg-2fa]: /requiring-2fa-for-package-publishing-and-settings-modification
69
+[authy]: https://authy.com/download/
70
+[google-authenticator]: https://support.google.com/accounts/answer/1066447
71
+[microsoft-authenticator]: https://www.microsoft.com/security/mobile-authenticator-app
72
+[webauthn]: https://webauthn.guide/
73
+[can-i-use]: https://caniuse.com/#search=webauthn
74
+[u2f]: https://en.wikipedia.org/wiki/Universal_2nd_Factor
75
+[windows-hello]: https://support.microsoft.com/en-us/windows/learn-about-windows-hello-and-set-it-up-dae28983-8242-bb2a-d3d1-87c9d265a5f0
76
+[touch-id]: https://support.apple.com/en-gb/HT204587
77
+[face-id]: https://support.apple.com/en-us/HT208108
78
+[yubikey]: https://www.yubico.com/
79
+[thetis]: https://thetis.io/
80
+[feitian]: https://www.ftsafe.com/
81
+[totp]: https://en.wikipedia.org/wiki/Time-based_one-time_password
content/getting-started/setting-up-your-npm-user-account/accessing-npm-using-2fa.mdx
new
+35
@@ -0,0 +1,35 @@
1
+---
2
+title: Accessing npm using two-factor authentication
3
+redirect_from: [ /getting-started/using-two-factor-authentication ]
4
+---
5
+
6
+## Sign in from the command line using WebAuthn
7
+
8
+1. On the command line, type the [`npm login`][login] command.
9
+
10
+2. When prompted, provide your username, password, and email address.
11
+
12
+ ```
13
+ user@host:~$ npm login
14
+ npm notice Log in on https://registry.npmjs.org/
15
+ Username: mona
16
+ Password:
17
+ Email: (this IS public) mona@github.com
18
+ npm notice Open https://www.npmjs.com/login/913c3ab1-89a0-44bd-be8d-d946e2e906f0 to use your security key for authentication or enter OTP from your authenticator app
19
+ ```
20
+
21
+3. If you have configured a security-key, open the provided URL shown in the command line. Alternatively, if you have configured a mobile authenticator skip to step 6.
22
+
23
+4. Click on *Use security key* and follow the browser specific steps to authenticate.
24
+
25
+ <Screenshot src="/getting-started/setting-up-your-npm-user-account/2fa-use-security-key.png" alt="Screenshot showing security key prompt" />
26
+
27
+5. Copy the generated token
28
+
29
+ <Screenshot src="/getting-started/setting-up-your-npm-user-account/webauthn-cli-login-token.png" alt="Screenshot showing a sample token generated while using WebAuthn for cli login" />
30
+
31
+6. Enter the one-time password into the CLI prompt.
32
+
33
+ <Prompt>Enter one-time password:</Prompt>
34
+
35
+[login]: https://docs.npmjs.com/cli/adduser
\ No newline at end of file
content/getting-started/setting-up-your-npm-user-account/configuring-two-factor-authentication.mdx
+110
-37
@@ -3,14 +3,17 @@ title: Configuring two-factor authentication
3
---
4
import shared from '../../../src/shared.js'
5
6
-You can enable two-factor authentication (2FA) on your npm user account to protect against unauthorized access to your account and packages.
6
+You can enable two-factor authentication (2FA) on your npm user account to protect against unauthorized access to your account and packages, either by using a [security key][webauthn] or [time-based one-time password (TOTP)][totp] mobile app.
7
8
## Prerequisites
9
10
Before you enable 2FA on your npm user account, you must:
11
12
* Update your npm client to version 5.5.1 or higher.
13
-* Install an authenticator application that can generate one-time passwords (such as [Authy](https://authy.com/download/), [Google Authenticator](https://support.google.com/accounts/answer/1066447), or [Microsoft Authenticator](https://www.microsoft.com/security/mobile-authenticator-app)) on a mobile device or second computer that will always be available when you work in your npm account.
13
+* To configure a security key requires a modern browser that support [WebAuthn][can-i-use]. This will allow you to configure a biometric devices such as Apple [Touch ID][touch-id], [Face ID][face-id], or [Windows Hello][windows-hello] as well as physical keys such as [Yubikey][yubikey], [Thetis][thetis], or [Feitian][feitian].
14
+* To configure TOTP you will need to install an authenticator application that can generate OTPs such as [Authy][authy], [Google Authenticator][google-authenticator], or [Microsoft Authenticator][microsoft-authenticator] on your mobile device.
15
+
16
+For more information on supported 2FA methods, see "[About two-factor authentication][about-two-factor-authentication]".
17
18
<Note>
19
@@ -18,9 +21,9 @@ Before you enable 2FA on your npm user account, you must:
21
22
</Note>
23
21
-## Configuring 2FA on the web
24
+## Configuring 2FA from the website
25
23
-### Enabling 2FA on the web
26
+### Enabling 2FA
27
28
1. <>{shared['user-login'].text}</>
29
@@ -30,33 +33,48 @@ Before you enable 2FA on your npm user account, you must:
33
34
<>{shared['account-settings'].image}</>
35
33
-3. On the profile settings page, under "Two-Factor Authentication", click **Enable 2FA**.
36
+3. On the account settings page, under "Two-Factor Authentication", click **Enable 2FA**.
37
38
<Screenshot src="/getting-started/setting-up-your-npm-user-account/2fa-enable.png" alt="Screenshot showing Enable 2FA button" />
39
37
-4. On the 2FA settings page, select the mode you would like to enable. For more information, see "[Two-factor authentication modes on npm](about-two-factor-authentication#two-factor-authentication-modes-on-npm)".
40
+4. When prompted provide your current account password and then click **Confirm password to continue**.
41
+
42
+5. On the 2FA method page, select the method you would like to enable and click **Continue**. For more information on supported 2FA methods, see "[About two-factor authentication][about-two-factor-authentication]".
43
+
44
+ <Screenshot src="/getting-started/setting-up-your-npm-user-account/device-selection.png" alt="Screenshot showing 2FA types" />
45
+
46
+6. Configure the 2FA method of your choice:
47
+
48
+ * When using a **security key**, provide a name for it and click **Add security key**. Follow the browser specific steps to add your security key.
49
39
- <Screenshot src="/getting-started/setting-up-your-npm-user-account/2fa-auth-pub-select.png" alt="Screenshot showing 2FA types" />
50
+ <Screenshot src="/getting-started/setting-up-your-npm-user-account/2fa-add-security-key.png" alt="Screenshot showing security key setup" />
51
41
-5. Click **Submit**.
52
+ Below is an example of configuration from Microsoft Edge running on a MacOS
53
+
54
+ <Screenshot src="/getting-started/setting-up-your-npm-user-account/touch-id-mac-edge.png" alt="Screenshot showing 2FA device selection" />
55
43
- <Screenshot src="/getting-started/setting-up-your-npm-user-account/2fa-auth-pub-submit.png" alt="Screenshot showing 2FA submit button" />
56
+ * When using an **authenticator application** on your phone, open it and scan the QR code on the two-step verification page. Enter the code generated by the app, then click **Verify**.
57
45
-6. Open your authenticator application on your phone, and, on the two-step verification page, scan the QR code with your phone.
58
+ <Screenshot src="/getting-started/setting-up-your-npm-user-account/2fa-verify.png" alt="Screenshot showing 2FA device selection" />
59
47
-7. Enter the code generated by the app, then click **Verify**.
60
+7. On the recovery code page, copy the recovery codes to your computer or other safe location that is not your second factor device. We recommend using a password manager.
61
49
- <Screenshot src="/getting-started/setting-up-your-npm-user-account/2fa-verify.png" alt="Screenshot showing 2FA verification" />
62
+ <Screenshot src="/getting-started/setting-up-your-npm-user-account/recovery-code.png" alt="Screenshot showing the Recovery Code page" />
63
51
-8. On the recovery code page, copy the recovery codes to your computer or other safe location that is not your second factor device. We recommend using a password manager to save your recovery codes. **If you are unable to access your phone, you will need to enter a recovery code when prompted for a one-time password.**
64
53
-9. Click **Go back to settings**.
65
+ _Recovery codes are the only way to recover your account if you lose access to your second factor device. There are 5 codes presented and each code can be used only once. You can [view and regenerate your recovery code][viewing-and-regenerating-recovery-code] from your 2FA settings page._
66
55
- <Screenshot src="/getting-started/setting-up-your-npm-user-account/go-back-to-settings.png" alt="Screenshot showing the Go back to settings button" />
67
+8. Click **Go back to settings** after confirming that you have saved your codes.
68
57
-### Removing 2FA on the web
69
+### Disabling 2FA for writes
70
59
-If you have 2FA enabled, you can remove it from your profile settings page.
71
+Check the [Authorization and writes][authorization-and-writes] section for more information on different operations that requires 2FA when this mode is enabled.
72
+
73
+<Note>
74
+
75
+**Note**: As a recommended setting, 2FA for write operations are _automatically enabled_ when setting up 2FA. The following steps explain how to disable it.
76
+
77
+</Note>
78
79
1. <>{shared['user-login'].text}</>
80
@@ -66,43 +84,78 @@ If you have 2FA enabled, you can remove it from your profile settings page.
84
85
<>{shared['account-settings'].image}</>
86
69
-3. On the profile settings page, under "Two-Factor Authentication", click **Modify 2FA**.
87
+3. On the account settings page, under "Two-Factor Authentication", click **Modify 2FA**.
88
89
<Screenshot src="/getting-started/setting-up-your-npm-user-account/2fa-modify.png" alt="Screenshot showing Modify 2FA button" />
90
73
-4. On the 2FA settings page, under "What should we protect?", select "Disable".
91
+4. From the "Manage Two-Factor Authentication" navigate to "Additional Options" section
92
+5. Clear the checkbox for "Require two-factor authentication for write actions" and click "Update Preferences"
93
75
- <Screenshot src="/getting-started/setting-up-your-npm-user-account/2fa-disable.png" alt="Screenshot showing Disable 2FA button" />
94
+ <Screenshot src="/getting-started/setting-up-your-npm-user-account/disable-2fa-button.png" alt="Screenshot showing a cleared check box to disable 2fa under Addition options" />
95
+
96
+### Disabling 2FA
97
+
98
+If you have 2FA enabled, you can remove it from your account settings page.
99
+
100
+<Note>
101
+
102
+**Note:** You cannot remove 2FA if you are a member of an organization that enforces 2FA. You can view the list of organizations memberships from your profile page under the "Organizations" tab.
103
+
104
+</Note>
105
77
-5. Click **Submit**.
106
+1. <>{shared['user-login'].text}</>
107
79
- <Screenshot src="/getting-started/setting-up-your-npm-user-account/2fa-disable-submit.png" alt="Screenshot showing Disable 2FA submit button" />
108
+ <>{shared['user-login'].image}</>
109
+
110
+2. <>{shared['account-settings'].text}</>
111
+
112
+ <>{shared['account-settings'].image}</>
113
+
114
+3. On the account settings page, under "Two-Factor Authentication", click **Modify 2FA**.
115
+
116
+ <Screenshot src="/getting-started/setting-up-your-npm-user-account/2fa-modify.png" alt="Screenshot showing Modify 2FA button" />
117
+
118
+4. Scroll to the bottom of the "Manage Two-Factor Authentication" page and click Disable 2FA.
119
+
120
+ <Screenshot src="/getting-started/setting-up-your-npm-user-account/2fa-disable.png" alt="Screenshot showing Disable 2FA button" />
121
+
122
+5. Agree to the prompt from the browser.
123
124
## Configuring 2FA from the command line
125
126
### Enabling 2FA from the command line
127
128
+Although WebAuthn can be used for authentication from both the web and the command line, it can only be configured from the web. When enabling 2FA from the command line, currently the only available option is to use an TOTP mobile app.
129
+
130
<Note>
131
132
**Note:** Settings you configure on the command line will also apply to your profile settings on the npm website.
133
134
</Note>
135
91
-1. On the command line, type the [`npm profile`](/cli/profile) command along with the option for the 2FA mode you want to enable:
92
- * To enable 2FA for authorization and writes, type:<br/>
93
- `npm profile enable-2fa auth-and-writes`
94
- * To enable 2FA for authorization only, type:<br/>
95
- `npm profile enable-2fa auth-only`
136
+1. If you are logged out on the command line, log in using `npm login` command.
137
97
-2. To add npm to your authenticator application, using the device with the app, you can either:
98
- * scan the QR code displayed on the command line.
99
- * type the number displayed below the QR code.
138
+2. On the command line, type the [`npm profile`](/cli/profile) command along with the option for the 2FA mode you want to enable:
139
+ * To enable 2FA for authorization and writes, type:<br/>
140
+ ```
141
+ npm profile enable-2fa auth-and-writes
142
+
143
+ ```
144
+ * To enable 2FA for authorization only, type:<br/>
145
+
146
+ ```
147
+ npm profile enable-2fa auth-only
148
+ ```
149
101
-3. When prompted to add an OTP code from your authenticator, on the command line, enter a one-time password generated by your authenticator app.
150
+3. To add npm to your authenticator application, using the device with the app, you can either:
151
+ * Scan the QR code displayed on the command line.
152
+ * Type the number displayed below the QR code.
153
+
154
+4. When prompted to add an OTP code from your authenticator, on the command line, enter a one-time password generated by your authenticator app.
155
156
### Sending a one-time password from the command line
157
105
-If you have enabled 2FA auth-and-writes, you will need to send the OTP from the command line for certain commands to work. To do this, append `--otp=123456` (where *123456* is the code generated by your authenticator) at the end of the command. Here are a few examples:
158
+If you have enabled 2FA auth-and-writes, you will need to send the TOTP from the command line for certain commands to work. To do this, append `--otp=123456` (where *123456* is the code generated by your authenticator) at the end of the command. Here are a few examples:
159
160
```
161
npm publish [<tarball>|<folder>][--tag <tag>] --otp=123456
@@ -115,23 +168,43 @@ npm unpublish [<@scope>/]<pkg>[@<version>] --otp=123456
168
169
### Removing 2FA from the command line
170
118
-1. On the command line, type the following command:
171
+1. If you are logged out on the command line, log in using `npm login` command.
172
+
173
+2. On the command line, type the following command:
174
175
```
176
npm profile disable-2fa
177
```
178
124
-2. When prompted, enter your npm password:
179
+3. When prompted, enter your npm password:
180
181
<Prompt>npm password:</Prompt>
182
128
-3. When prompted for a one-time password, enter a password from your authenticator app:
183
+4. When prompted for a one-time password, enter a password from your authenticator app:
184
185
<Prompt>Enter one-time password from your authenticator: <PromptReply>123456</PromptReply></Prompt>
186
132
-## Resolving OTP errors
187
+## Resolving TOTP errors
188
134
-If you are entering what seems to be a valid OTP but you see an error, be sure that you are using the correct authenticator account. If you have multiple authenticator accounts, using an OTP from the wrong account will cause an error.
189
+If you are entering what seems to be a valid [TOTP][totp] but you see an error, be sure that you are using the correct authenticator account. If you have multiple authenticator accounts, using an TOTP from the wrong account will cause an error.
190
191
Also, when you reset two-factor authentication after it has been disabled, the authenticator might create a second account with the same name. Please see the authenticator documentation to delete the old account.
192
193
+[about-two-factor-authentication]: /about-two-factor-authentication
194
+[authorization-and-writes]: /about-two-factor-authentication#authorization-and-writes
195
+[login]: https://docs.npmjs.com/cli/adduser
196
+[recovering-your-2fa-enabled-account]: /recovering-your-2fa-enabled-account
197
+[can-i-use]: https://caniuse.com/#search=webauthn
198
+[viewing-and-regenerating-recovery-code]: /recovering-your-2fa-enabled-account#viewing-and-regenerating-recovery-code
199
+[totp]: https://en.wikipedia.org/wiki/Time-based_one-time_password
200
+[authy]: https://authy.com/download/
201
+[google-authenticator]: https://support.google.com/accounts/answer/1066447
202
+[microsoft-authenticator]: https://www.microsoft.com/security/mobile-authenticator-app
203
+[webauthn]: https://webauthn.guide/
204
+[u2f]: https://en.wikipedia.org/wiki/Universal_2nd_Factor
205
+[windows-hello]: https://support.microsoft.com/en-us/windows/learn-about-windows-hello-and-set-it-up-dae28983-8242-bb2a-d3d1-87c9d265a5f0
206
+[touch-id]: https://support.apple.com/en-gb/HT204587
207
+[face-id]: https://support.apple.com/en-us/HT208108
208
+[yubikey]: https://www.yubico.com/
209
+[thetis]: https://thetis.io/
210
+[feitian]: https://www.ftsafe.com/
\ No newline at end of file
content/getting-started/setting-up-your-npm-user-account/recovering-your-2fa-enabled-account.mdx
+75
-15
@@ -1,40 +1,100 @@
1
---
2
title: Recovering your 2FA-enabled account
3
---
4
+import shared from '../../../src/shared.js'
5
5
-When you have two-factor access enabled on your account, and you lose the ability to provide the one-time password, you may be able to recover your account.
6
+When you have two-factor access enabled on your account, and you lose access to your 2FA device, you may be able to recover your account using the following methods.
7
7
-### Misplaced second factor device
8
+## Misplaced second factor device
9
+If you have misplaced the device that provided second-factor authentication, you can use the recovery codes generated when you [enabled 2FA][setup-recovery-codes] to access your account.
10
9
-If you have misplaced the device that provided second-factor authentication, you can use the recovery codes generated when you enabled 2FA to access your account.
11
+### Using recovery code on the web
12
+1. Locate the recovery codes generated that you have saved.
13
+
14
+2. <>{shared['user-login'].text}</>
15
+
16
+ <>{shared['user-login'].image}</>
17
+
18
+3. Click on "Use recovery code" from the next screen
19
+
20
+ <Screenshot src="/getting-started/setting-up-your-npm-user-account/recovery-code-link.png" alt="Screenshot showing Security Key prompt with a link to navigate to the recovery code input screen" />
21
+
22
+ _Note: If you have configured to use TOTP, you will see an TOTP prompt instead_
23
+
24
+4. Enter an unused recovery code in the "Use a Recovery Code" prompt
25
+
26
+ <Screenshot src="/getting-started/setting-up-your-npm-user-account/user-a-recovery-code.png" alt="Screenshot showing use a recovery code prompt with an input box to enter the recovery code" />
27
+
28
+5. You are now logged into npm.
29
+
30
+5. Follow the steps mentioned in "[Removing 2FA on the web][removing-2fa-on-the-web]" to disable 2FA
31
+
32
+### Using recovery code from the command line
33
34
1. Locate the recovery codes generated when you enabled 2FA on your account.
12
-2. If you are logged out, on the command line, log in using your npm username and npm password.
35
14
- ```
15
- npm login
16
- ```
36
+2. If you are logged out on the command line, log in using `npm login` command with your username and npm password.
37
18
-3. When prompted for an OTP, enter a recovery code.
19
-4. Once you are logged in, type `npm profile disable-2fa` and enter your npm password if prompted.
38
5. Enter an unused recovery code when you see this prompt:
39
22
- <Prompt>Enter one-time password from your authenticator:</Prompt>
40
+ <Prompt>Enter one-time password:</Prompt>
41
+
42
+4. Once you are logged in, use the below and enter your npm password if prompted.
43
+
44
+ ```
45
+ npm profile disable-2fa
46
+ ```
47
+
48
+5. Enter another unused recovery code when you see this prompt:
49
+
50
+ <Prompt>Enter one-time password:</Prompt>
51
52
5. npm will confirm that two-factor authentication has been disabled.
25
-6. type `npm profile enable-2fa` to re-enable 2FA, assign a different device to your account, and generate new recovery codes.
53
+
54
+6. Follow the steps outlined in "[Configuring two-factor authentication][configuring-two-factor-authentication]" to re-enable 2FA and generate new recovery codes.
55
56
<Note>
57
29
-**Note:** Using the recovery codes to re-enable 2FA may create a second authenticator account with the same npm account name.
58
+**Note:** Using the recovery codes to re-enable 2FA may create a new authenticator account with the same npm account name.
59
31
-To delete the old authenticator account, follow the steps for the authenticator.
60
+If you are using a [time-based one-time password (TOTP)][totp] mobile app and want to delete the old authenticator account, follow the steps for the authenticator.
61
62
</Note>
63
35
-### Misplaced recovery codes
64
+## Viewing and regenerating recovery code
65
37
-If you have misplaced both the device that provided second-factor authentication and your recovery codes, we may be unable to help you recover your account. If you have any questions, please [contact npm Support][contact-support].
66
+<Note>
67
+
68
+**Note:** Once you regenerate a set of code, all previous recovery codes become invalid. Each code can be used only once.
69
+
70
+</Note>
71
+
72
+1. <>{shared['user-login'].text}</>
73
+
74
+ <>{shared['user-login'].image}</>
75
+
76
+2. <>{shared['account-settings'].text}</>
77
+
78
+ <>{shared['account-settings'].image}</>
79
80
+3. On the account settings page, under "Two-Factor Authentication", click **Modify 2FA**.
81
+
82
+ <Screenshot src="/getting-started/setting-up-your-npm-user-account/2fa-modify.png" alt="Screenshot showing Modify 2FA button" />
83
+
84
+4. Click "Manage Recovery Codes'' to view your recovery codes
85
+
86
+ <Screenshot src="/getting-started/setting-up-your-npm-user-account/view-recovery-codes.png" alt="Screenshot showing existing recovery codes and a button to generate set of recovery codes" />
87
+
88
+5. Click "Regenerate Code" to generate a new set of codes.
89
+
90
+## Misplaced recovery codes
91
+
92
+If you have misplaced both the device that provided second-factor authentication and your recovery codes, we may be unable to help you recover your account. If you have any questions, please [contact npm Support][contact-support].
93
94
[contact-support]: https://www.npmjs.com/support
95
+[configuring-two-factor-authentication]: /configuring-two-factor-authentication
96
+[setup-recovery-codes]: /configuring-two-factor-authentication#enabling-2fa-on-the-web
97
+[removing-2fa-on-the-web]: /configuring-two-factor-authentication#removing-2fa-on-the-web
98
+[using-recovery-code-on-the-web]: /recovering-your-2fa-enabled-account#using-recovery-code-on-the-web
99
+[viewing-and-regenerating-recovery-code]: #viewing-and-regenerating-recovery-code
100
+[totp]: https://en.wikipedia.org/wiki/Time-based_one-time_password
content/packages-and-modules/securing-your-code/requiring-2fa-for-package-publishing-and-settings-modification.mdx
+5
-4
@@ -3,9 +3,9 @@ title: Requiring 2FA for package publishing and settings modification
3
---
4
import shared from '../../../src/shared.js'
5
6
-To protect your packages, as a package publisher, you can require everyone who has write access to a package to have two-factor authentication (2FA) enabled. This will require that users provide a one-time password in addition to their login token when they publish the package. For more information, see "[Configuring two-factor authentication][config-2fa]".
6
+To protect your packages, as a package publisher, you can require everyone who has write access to a package to have two-factor authentication (2FA) enabled. This will require that users provide 2FA credentials in addition to their login token when they publish the package. For more information, see "[Configuring two-factor authentication][config-2fa]".
7
8
-You may also choose to allow publishing with either two-factor authentication _or_ with [automation tokens][creating-tokens]. This lets you configure automation tokens in a CI/CD workflow, but requires two-factor authentication from interactive publishes.
8
+You may also choose to allow publishing with either two-factor authentication _or_ with [automation tokens][creating-tokens]. This lets you configure automation tokens in a CI/CD workflow, but requires two-factor authentication from interactive publishes.
9
10
## Configuring two-factor authentication
11
@@ -24,10 +24,10 @@ You may also choose to allow publishing with either two-factor authentication _o
24
With this option, a maintainer can publish a package or change the package settings whether they have two-factor authentication enabled or not. This is the least secure setting.
25
26
2. **Require two-factor authentication or automation tokens**
27
- With this option, maintainers must have two-factor authentication enabled for their account. If they publish a package interactively, using the `npm publish` command, they will be required to enter a one-time passcode when they perform the publish. However, maintainers may also create an [automation token][creating-tokens] and use that to publish. A one-time passcode is _not_ required when using an automation token, making it useful for continuous integration and continuous deployment workflows.
27
+ With this option, maintainers must have two-factor authentication enabled for their account. If they publish a package interactively, using the `npm publish` command, they will be required to enter 2FA credentials when they perform the publish. However, maintainers may also create an [automation token][creating-tokens] and use that to publish. A second factor is _not_ required when using an automation token, making it useful for continuous integration and continuous deployment workflows.
28
29
3. **Two-factor authentication only**
30
- With this option, a maintainer must have two-factor authentication enabled for their account, and they must publish interactively. Maintainers will be required to enter a one-time passcode when they perform the publish.
30
+ With this option, a maintainer must have two-factor authentication enabled for their account, and they must publish interactively. Maintainers will be required to enter 2FA credentials when they perform the publish.
31
32
<Screenshot src="/packages-and-modules/securing-your-code/2fa-package-require.png" alt="Screenshot showing the require two-factor option for a package" />
33
@@ -36,3 +36,4 @@ You may also choose to allow publishing with either two-factor authentication _o
36
<Screenshot src="/packages-and-modules/securing-your-code/2fa-package-update.png" alt="Screenshot showing the update package settings button" />
37
38
[config-2fa]: configuring-two-factor-authentication
39
+[creating-tokens]: creating-and-viewing-access-tokens
src/.DS_Store
Binary files /dev/null and b/src/.DS_Store differ
src/gatsby-theme-doctornpm/nav.yml
+2
@@ -21,6 +21,8 @@
21
url: /about-two-factor-authentication
22
- title: Configuring two-factor authentication
23
url: /configuring-two-factor-authentication
24
+ - title: Accessing npm using two-factor authentication
25
+ url: /accessing-npm-using-2fa
26
- title: Recovering your 2FA-enabled account
27
url: /recovering-your-2fa-enabled-account
28
- title: Managing your npm user account
src/nav-base.yml
+2
@@ -18,6 +18,8 @@
18
url: /about-two-factor-authentication
19
- title: Configuring two-factor authentication
20
url: /configuring-two-factor-authentication
21
+ - title: Accessing npm using two-factor authentication
22
+ url: /accessing-npm-using-2fa
23
- title: Recovering your 2FA-enabled account
24
url: /recovering-your-2fa-enabled-account
25
- title: Managing your npm user account
static/getting-started/setting-up-your-npm-user-account/2fa-add-security-key.png
Binary files /dev/null and b/static/getting-started/setting-up-your-npm-user-account/2fa-add-security-key.png differ
static/getting-started/setting-up-your-npm-user-account/2fa-auth-pub-submit.png
Binary files a/static/getting-started/setting-up-your-npm-user-account/2fa-auth-pub-submit.png and /dev/null differ
static/getting-started/setting-up-your-npm-user-account/2fa-disable.png
Binary files a/static/getting-started/setting-up-your-npm-user-account/2fa-disable.png and b/static/getting-started/setting-up-your-npm-user-account/2fa-disable.png differ
static/getting-started/setting-up-your-npm-user-account/2fa-modify.png
Binary files a/static/getting-started/setting-up-your-npm-user-account/2fa-modify.png and b/static/getting-started/setting-up-your-npm-user-account/2fa-modify.png differ
static/getting-started/setting-up-your-npm-user-account/2fa-use-security-key.png
Binary files /dev/null and b/static/getting-started/setting-up-your-npm-user-account/2fa-use-security-key.png differ
static/getting-started/setting-up-your-npm-user-account/cli-login-screen.png
Binary files /dev/null and b/static/getting-started/setting-up-your-npm-user-account/cli-login-screen.png differ
static/getting-started/setting-up-your-npm-user-account/device-selection.png
Binary files /dev/null and b/static/getting-started/setting-up-your-npm-user-account/device-selection.png differ
static/getting-started/setting-up-your-npm-user-account/disable-2fa-button.png
Binary files /dev/null and b/static/getting-started/setting-up-your-npm-user-account/disable-2fa-button.png differ
static/getting-started/setting-up-your-npm-user-account/lost-recovery-code.png
Binary files /dev/null and b/static/getting-started/setting-up-your-npm-user-account/lost-recovery-code.png differ
static/getting-started/setting-up-your-npm-user-account/open-support-ticket.png
Binary files /dev/null and b/static/getting-started/setting-up-your-npm-user-account/open-support-ticket.png differ
static/getting-started/setting-up-your-npm-user-account/recovery-code-link.png
Binary files /dev/null and b/static/getting-started/setting-up-your-npm-user-account/recovery-code-link.png differ
static/getting-started/setting-up-your-npm-user-account/recovery-code.png
Binary files /dev/null and b/static/getting-started/setting-up-your-npm-user-account/recovery-code.png differ
static/getting-started/setting-up-your-npm-user-account/signin-screen.png
Binary files /dev/null and b/static/getting-started/setting-up-your-npm-user-account/signin-screen.png differ
static/getting-started/setting-up-your-npm-user-account/touch-id-mac-edge.png
Binary files /dev/null and b/static/getting-started/setting-up-your-npm-user-account/touch-id-mac-edge.png differ
static/getting-started/setting-up-your-npm-user-account/user-a-recovery-code.png
Binary files /dev/null and b/static/getting-started/setting-up-your-npm-user-account/user-a-recovery-code.png differ
static/getting-started/setting-up-your-npm-user-account/view-recovery-codes.png
Binary files /dev/null and b/static/getting-started/setting-up-your-npm-user-account/view-recovery-codes.png differ
static/getting-started/setting-up-your-npm-user-account/webauthn-cli-login-token.png
Binary files /dev/null and b/static/getting-started/setting-up-your-npm-user-account/webauthn-cli-login-token.png differ