A secure ASP.NET MVC web application that implements Google Authenticator-style two-factor authentication (2FA) for enhanced login security.
1. Clone the repository
git clone https://github.com/Prithivi-au/GoogleAuthenticator.git cd GoogleAuthenticator
2. Open in Visual Studio
- Open GAuthenticator.sln in Visual Studio
- Restore NuGet packages (right-click solution → Restore NuGet Packages)
3. Configure the application
- Open Web.config
- Update the following settings in
<add key="GAuthPrivateKey" value="YOUR_SECRET_KEY_HERE"/> <add key="GAuthEnable" value="1"/>
4. Run the application
- Press F5 or click "Start Debugging"
- Navigate to http://localhost:port/Login/Login
TestUser12345> ⚠️ Important: Change these credentials in production!
1. Login with your credentials
2. Scan QR Code with your authenticator app (Google Authenticator, Authy, etc.)
3. Enter Verification Code from your authenticator app
4. Access Protected Area - you're now logged in with 2FA enabled
<appSettings> <!-- Your secret key for generating unique user keys --> <add key="GAuthPrivateKey" value="YOUR_SECRET_KEY_HERE"/> <!-- Enable/disable 2FA (1 = enabled, 0 = disabled) --> <add key="GAuthEnable" value="1"/> </appSettings>
1. Change Default Credentials: Update the hardcoded username/password in LoginController.cs
2. Use Strong Secret Key: Generate a strong, random secret key for GAuthPrivateKey
3. Enable HTTPS: Always use HTTPS in production
4. Database Integration: Replace hardcoded credentials with database authentication
1. TwoFactorAuthenticator: Core 2FA functionality
2. QR Code Generation: Automatic QR code creation for easy setup
3. Session Management: Secure session handling
4. Cookie-based Remember: Optional device remembering
1. User enters username/password
2. System validates credentials
3. If 2FA is enabled:
- Generate unique key for user
- Display QR code for authenticator app setup
- Validate TOTP code from authenticator app
- Set authentication cookie if valid
4. Redirect to protected area
public class TwoFactorService
{
public TwoFactorSetupResult SetupTwoFactor(string username, string password)
{
// Validate credentials
if (username == "prithivi" && password == "12345")
{
// Check if 2FA is enabled
if (ConfigurationManager.AppSettings["GAuthEnable"] == "1")
{
// Check if user has already set up 2FA
if (!HasExistingTwoFactorSetup(username))
{
// Generate QR code for 2FA setup
string userSecretKey = username + ConfigurationManager.AppSettings["GAuthPrivateKey"];
byte[] userUniqueKey = Encoding.ASCII.GetBytes(userSecretKey);
TwoFactorAuthenticator TwoFacAuth = new TwoFactorAuthenticator();
var setupInfo = TwoFacAuth.GenerateSetupCode("MyApp", username, userUniqueKey, 3, true);
return new TwoFactorSetupResult
{
Success = true,
QrCodeUrl = setupInfo.QrCodeSetupImageUrl,
ManualEntryKey = setupInfo.ManualEntryKey,
UserSecretKey = userSecretKey
};
}
else
{
return new TwoFactorSetupResult { Success = true, AlreadySetup = true };
}
}
}
return new TwoFactorSetupResult { Success = false };
}
private bool HasExistingTwoFactorSetup(string username)
{
// Check if user has existing 2FA setup
return false; // Implement your logic here
}
}
public class TwoFactorValidationService
{
public ValidationResult ValidateTwoFactorCode(string code, string userSecretKey)
{
TwoFactorAuthenticator TwoFacAuth = new TwoFactorAuthenticator();
byte[] userUniqueKey = Encoding.ASCII.GetBytes(userSecretKey);
bool isValid = TwoFacAuth.ValidateTwoFactorPIN(userUniqueKey, code);
if (isValid)
{
// Store successful validation
StoreTwoFactorSuccess(userSecretKey);
return new ValidationResult
{
Success = true,
Message = "Authentication successful"
};
}
return new ValidationResult
{
Success = false,
Message = "Invalid code"
};
}
private void StoreTwoFactorSuccess(string userSecretKey)
{
// Implement your storage logic here
// Could be database, cache, or session
}
}
public class ValidationResult
{
public bool Success { get; set; }
public string Message { get; set; }
}
public class TwoFactorSetupResult
{
public bool Success { get; set; }
public string QrCodeUrl { get; set; }
public string ManualEntryKey { get; set; }
public string UserSecretKey { get; set; }
public bool AlreadySetup { get; set; }
}
<configuration>
<appSettings>
<!-- Your secret key for generating unique user keys -->
<add key="GAuthPrivateKey" value="YOUR_SECRET_KEY_HERE"/>
<!-- Enable/disable 2FA (1 = enabled, 0 = disabled) -->
<add key="GAuthEnable" value="1"/>
</appSettings>
<system.web>
<authentication mode="Forms">
<forms loginUrl="~/Login/Login" timeout="2880"/>
</authentication>
<compilation debug="true" targetFramework="4.6.1"/>
<httpRuntime targetFramework="4.6.1"/>
</system.web>
</configuration>
<!-- packages.config --> <packages> <package id="GoogleAuthenticator" version="3.0.0" targetFramework="net461" /> <package id="Microsoft.AspNet.Mvc" version="5.2.7" targetFramework="net461" /> <package id="Microsoft.AspNet.WebPages" version="3.2.7" targetFramework="net461" /> <package id="Microsoft.AspNet.Razor" version="3.2.7" targetFramework="net461" /> <package id="Newtonsoft.Json" version="12.0.2" targetFramework="net461" /> </packages>
1. Build the application in Release mode
2. Publish to a folder
3. Copy files to IIS web directory
4. Configure IIS application pool for .NET Framework 4.6.1
5. Update web.config with production settings
1. Create an Azure App Service
2. Configure for .NET Framework 4.6.1
3. Deploy using Visual Studio or Azure DevOps
4. Update connection strings and app settings
Replace hardcoded credentials with database authentication:
// Example with Entity Framework
var user = db.Users.FirstOrDefault(u => u.Username == login.UserName);
if (user != null && VerifyPassword(login.Password, user.PasswordHash))
{
// Authentication logic here
}
Modify CSS files in the Content/ directory to match your brand.
1. Fork the repository
2. Create a feature branch (git checkout -b feature/amazing-feature)
3. Commit your changes (git commit -m 'Add amazing feature')
4. Push to the branch (git push origin feature/amazing-feature)
5. Open a Pull Request
If you have any questions or need help with this project, please open an issue on GitHub or contact the maintainer.
Industry-standard time-based one-time passwords
Each user gets a unique secret key
Secure session management with Forms Authentication
Configured for secure communication
Get the complete ASP.NET MVC source code, configuration examples, and deployment guides for implementing Google Authenticator-style two-factor authentication.
View on GitHub