PasswordlessAuth

PasswordlessAuth provides functionality that can be used in an authentication or verification system, such as a passwordless or multi-factor authentication flow, or for verifying a user's ownership of a phone number, email address or any other identifying address.

• Generate verification codes
• Verify a user's attempt at entering a code
• Rate limit attempts
• Expire codes

This library doesn't deal with sending the codes to recipients.

See Usage for example usage.

Documentation

Documentation is available at https://hexdocs.pm/passwordless_auth

Installation

Add :passwordless_auth to your list of dependencies in mix.exs:

def deps do
  [
    {:passwordless_auth, "~> 0.3.0"}
  ]
end

Configuration

The following PasswordlessAuth config can be set in your config/config.exs file:

config :passwordless_auth,
  # How long codes are valid for
  verification_code_ttl: 300, # seconds; default: 300
  # Rate limiting: how many failed attempts are allowed before the timeout is applied
  num_attempts_before_timeout: 5, # default: 5
  # Rate limiting: how long to disallow attempts after the limit has been reached
  rate_limit_timeout_length: 60, # seconds; default: 60
  # How often to clear out expired codes
  garbage_collector_frequency: 30 # seconds; default: 30

Usage

Here's an example where the code is sent to a recipient's phone number using ExTwilio.

1. Generate a verification code for the recipient

User enters their phone number to request a verification code.

code = PasswordlessAuth.generate_code("+447123456789")
=> "123456"

2. Send the code to the recipient

This library doesn't deal with SMS or emails, so this bit is up to you.

ExTwilio.Message.create(%{
  to: "+447123456789",
  body: "Your code is #{code}"
})

3. Verify the code

Recipient receives a text message with their verification code. They enter it into your system and you verify that it is correct.

attempt_code = "123456" # The user's attempt at entering the correct verification code.
PasswordlessAuth.verify_code(
  "+447123456789",
  attempt_code
)

Returns true or false.

Once a code has been verified, you can remove it so that it can't be used again before it expires.

PasswordlessAuth.remove_code("+447123456789")