Two-Factor Login (TOTP)

<cfscript>
    /**
     * Initialize SecureRandom and Base32 codec
     */
    variables.generator = createObject("java", "java.security.SecureRandom").getInstance("SHA1PRNG");
    variables.base32 = createObject("java", "org.apache.commons.codec.binary.Base32").init();
    variables.alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";

    /**
     * Validate a 6-digit TOTP code
     */
    public boolean function validateTOTP(required string secret, required string code, numeric window = 1) {
        var step = JavaCast("long", createObject("java", "java.lang.System").currentTimeMillis() / 1000 / 30);
        for (var i = 0; i <= arguments.window; i++) {
            if (getOneTimeToken(arguments.secret, step - i) == arguments.code) {
                return true;
            }
        }
        return false;
    }

    /**
     * Compute TOTP code for a given counter
     */
    private string function getOneTimeToken(required string base32Secret, required numeric counter) {
        var key = variables.base32.decode(base32Secret);
        var mac = createObject("java", "javax.crypto.Mac").getInstance("HmacSHA1");
        mac.init(createObject("java", "javax.crypto.spec.SecretKeySpec").init(key, "HmacSHA1"));

        var buf = createObject("java", "java.nio.ByteBuffer").allocate(8);
        buf.putLong(arguments.counter);
        var hmacBytes = mac.doFinal(buf.array());

        var offset = bitAnd(hmacBytes[arrayLen(hmacBytes)], 15);
        var binary = bitOr(bitOr(bitSHLN(bitAnd(hmacBytes[offset + 1], 127), 24), bitSHLN(bitAnd(hmacBytes[offset + 2], 255), 16)),
                           bitOr(bitSHLN(bitAnd(hmacBytes[offset + 3], 255), 8), bitAnd(hmacBytes[offset + 4], 255)));

        var otp = binary mod 1000000;
        return numberFormat(otp, "000000");
    }
</cfscript>

<cfinclude template="validateTotp.cfm" />

<cfscript>
    // SQL SERVER Table Creation
    /**
        CREATE TABLE usersdata (
            id INT IDENTITY(1,1) PRIMARY KEY,
            email VARCHAR(255) NOT NULL UNIQUE,
            totp_secret VARCHAR(255) DEFAULT NULL,
            uri VARCHAR(255) DEFAULT NULL
        );
    */

    // Initialize database connection (using queryExecute directly)
    datasource = "localDB";

    /**
     * Generate a new Base32 secret key
     * @param length Desired length of secret key (default is 20 characters)
     */
    function generateTOTPSecret(numeric length = 20) {
        variables.secret = "";
        variables.alphaLen = len(variables.alphabet);
        for (variables.i = 1; i <= arguments.length; i++) {
            variables.idx = variables.generator.nextInt(alphaLen);
            secret &= mid(variables.alphabet, idx + 1, 1);
        }
        return secret;
    }

    /**
     * Generate a PNG QR code for Google Authenticator using ZXing
     * @return Path to the saved QR code file
     */
    public binary function generateQRCode(required string secret,
                                         required string accountName,
                                         string issuer = "",
                                         numeric width = 200,
                                         numeric height = 200) {
        // Build the otpauth URL
        var label = URLEncodedFormat(arguments.accountName);
        var secretGenerated = arguments.secret;
        var userEmail = arguments.accountName;
        var issuerParam = len(arguments.issuer) ? URLEncodedFormat(arguments.issuer) & ":" : "";
        var paramString = "secret=" & arguments.secret & (len(arguments.issuer) ? "&issuer=" & URLEncodedFormat(arguments.issuer) : "");
        var otpauthURL = "otpauth://totp/" & issuerParam & label & "?" & paramString;

        // Save to database using queryExecute
        sql = "INSERT INTO usersdata (email, totp_secret, uri) VALUES (:userEmail, :secretGenerated, :otpauthURL)";
        params = {
            userEmail = userEmail,
            secretGenerated = secretGenerated,
            otpauthURL = otpauthURL
        };
        queryExecute(sql, params, {datasource: datasource});

        // Use ZXing classes (ensure zxing-core and zxing-javase JARs are in the CF lib folder)
        var QRCodeWriter = createObject("java", "com.google.zxing.qrcode.QRCodeWriter");
        var BarcodeFormat = createObject("java", "com.google.zxing.BarcodeFormat");
        var bitMatrix = QRCodeWriter.encode(otpauthURL, BarcodeFormat.QR_CODE, arguments.width, arguments.height);

        var baos = createObject("java", "java.io.ByteArrayOutputStream").init();
        createObject("java", "com.google.zxing.client.j2se.MatrixToImageWriter").writeToStream(bitMatrix, "PNG", baos);
        return baos.toByteArray();
    }

    // Main form handling logic
    if (!structKeyExists(FORM, "userEmail") && !structKeyExists(FORM, "totpCode")) {
        writeOutput('<form method="POST">
            <label for="userEmail">Enter your email to generate:</label>
            <input type="email" name="userEmail" required>
            <button type="submit">Generate</button>
        </form>');
    } else if (structKeyExists(FORM, "userEmail")) {
        variables.userEmail = FORM.userEmail;

        try {
            // Fetch existing secret using queryExecute
            sql = "SELECT totp_secret FROM usersdata WHERE email = :userEmail";
            params = {userEmail = userEmail};
            result = queryExecute(sql, params, {datasource: datasource});

            if (result.RecordCount > 0) {
                // Secret exists, prompt for validation
                writeOutput('<form method="POST">
                    <label for="totpCode">Enter your TOTP code:</label>
                    <input type="text" name="totpCode" required>
                    <input type="hidden" name="secret" value="#result.totp_secret[1]#">
                    <button type="submit">Verify</button>
                </form>');
            } else {
                // Generate and save QR code for new user
                variables.totpSecret = generateTOTPSecret();
                variables.qrImageBytes = generateQRCode(secret=totpSecret, accountName=userEmail, issuer="gttApp");

                writeOutput('<h3>You are not setup MFA yet, So please scan this QR Code with your Authenticator App:</h3>');
                writeOutput('<img src="data:image/png;base64,#toBase64(variables.qrImageBytes)#" alt="QR Code">');
                writeOutput('<h3>Enter Secret Manually: #totpSecret#</h3>');
            }
        } catch (any e) {
            writeOutput("Error: " & e.message);
        }
    } else if (structKeyExists(FORM, "totpCode")) {
        variables.valid = validateTOTP(FORM.secret, FORM.totpCode);
        variables.message = valid ? "Authentication successful!" : "Invalid TOTP code.";
        writeOutput("<h3>#message#</h3>");
    }
</cfscript>

<input type="hidden" name="secret" value="#result.totp_secret[1]#">

variables.valid = validateTOTP(FORM.secret, FORM.totpCode);

if (structKeyExists(FORM, "totpCode")) {
    // identify the user from the session set after the password check, not from a form field
    var email = session.pendingMfaEmail ?: "";
    var row = queryExecute(
        "SELECT totp_secret, last_used_step FROM usersdata WHERE email = :email",
        { email: { value: email, cfsqltype: "cf_sql_varchar" } },
        { datasource = "localDB" }
    );

    var secret = decryptSecret(row.totp_secret); // see the Encryption lesson
    var matchedStep = validateTOTPStep(secret, FORM.totpCode); // returns the step, or 0

    if (matchedStep > 0 AND matchedStep > row.last_used_step) {
        queryExecute(
            "UPDATE usersdata SET last_used_step = :step WHERE email = :email",
            {
                step: { value: matchedStep, cfsqltype: "cf_sql_bigint" },
                email: { value: email, cfsqltype: "cf_sql_varchar" }
            },
            { datasource = "localDB" }
        );
        sessionRotate();
        session.loggedIn = true;
        writeOutput("<h3>Authentication successful!</h3>");
    } else {
        writeOutput("<h3>Invalid TOTP code.</h3>");
    }
}