spec 1 linked patterns checked
OWASP Multifactor Authentication Cheat Sheet
Documents MFA factors, authenticator app and push options, SMS and email caveats, passkeys, recovery codes, lost-factor recovery, remember-device controls, risk-based prompts, factor change protection, and user notification.
Read with a purpose
What this source can teach
Use this source to check a technical or accessibility requirement against its exact wording and scope.
- Start with the original. Open the source and find the guidance or example relevant to your task.
- Trace the connection. Use the claim notes below to see how this site applies the source to specific patterns.
- Check the setting. Compare the source's platform, people, and constraints with your own decision.
Pattern Decisions This Source Supports
| Pattern | Supported decision | Required contract | Claim note |
|---|---|---|---|
| Two-factor authentication | Choose two-factor authentication when the user must satisfy an additional factor after a primary credential, SSO return, passkey flow, risk signal, new device, or sensitive action. | The challenge appears only when the server requires additional verification and the protected action remains blocked until success. | OWASP supports MFA factor choices, recovery codes, lost-factor recovery, remember-device controls, risk-based prompts, factor change protection, and notifications. |
Comparisons supported by this source
- Two-factor authentication vs sign in vs login vs password reset
OWASP supports MFA factors, recovery codes, lost-factor recovery, remember-device behavior, factor-change protection, and notifications.
Evidence Role
This source is treated as spec evidence. Its value comes from the specific claims and setting described above.
Publisher: OWASP Cheat Sheet Series. Last checked: .